Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 10:58

General

  • Target

    cc3fbf3f80bfbaf5d16717b81500c860_NeikiAnalytics.exe

  • Size

    783KB

  • MD5

    cc3fbf3f80bfbaf5d16717b81500c860

  • SHA1

    f2fef8ea8c34302bce93fb0be3efb7d26a12c6f4

  • SHA256

    dd88e5d49d2c52dc1b9be99bf0f4ebc6f971cb64a4455674a4cc2a7fed0fd6a1

  • SHA512

    64a323d62d7fc7165c9e4534d4284d290442ecf2844b199402901b8e4ad746bb378a3309f11e2b09d506c6837ab44baea407d853dadb5149a7c4fc503eecd4f7

  • SSDEEP

    12288:M13ULO2oiSGUGHp2O0GnhGyv9JBrn+KNBKVaJqav+Y8vyQA5DRz:M9sO2G1gp2wUqBrn/BM61C

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 5 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc3fbf3f80bfbaf5d16717b81500c860_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cc3fbf3f80bfbaf5d16717b81500c860_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 156
      2⤵
      • Program crash
      PID:2992

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3012-0-0x0000000000400000-0x00000000004CD000-memory.dmp

          Filesize

          820KB

        • memory/3012-1-0x0000000000400000-0x00000000004CD000-memory.dmp

          Filesize

          820KB