Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 00:19
Behavioral task
behavioral1
Sample
4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
4ccfca9af3375bdeae3b384305564a00
-
SHA1
bdc0dcec8b863ecf7aa35490e67c62f78cbc5de6
-
SHA256
05f7e41678aa8de17aa2da086eb932bc272df112ce52427e67229b11eb48807b
-
SHA512
c39dee00a42d32ab0eb8e1e3d634ee389c75d8f43b990ac56d0a55cf674c2cba5e8d176467d47e0c052f553f107d1a17c3dd18b920c7c0aa4711509f3f06bd49
-
SSDEEP
24576:+6ljTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT8:llw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4344 svrwsc.exe -
resource yara_rule behavioral2/memory/468-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/files/0x00080000000233f9-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe File created C:\Windows\SysWOW64\svrwsc.exe 4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
PID:468
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4344
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5596961e6729c94362fe227555c9eca70
SHA1d43889748c369eceecee88defbd21b84a5b68ced
SHA2560f2b87271c1c6c67612c1f5c04509e1398c424ba086de51af278b5457464ab31
SHA512f5f6e8f00dce1923011188839ad809d1170e4561faf008c959fee2ef780fd8f660068e088b37f419e12d51a74d07a7ee7e266d49670bb28dfdc8943fce104d31