e13c0f9b20ac39ee663843af86145050cbfef47387088bb6fffa9c3955bf7c10

Analysis

max time kernel
147s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
Size

2.0MB
MD5

d620ce87694d6aaf4851ea0b203b03a0
SHA1

e33d49f83dd531bfd0f8a595526c29e84950247f
SHA256

e13c0f9b20ac39ee663843af86145050cbfef47387088bb6fffa9c3955bf7c10
SHA512

831f6b0b3c2e675efc4dc3bafb63bcaf3f307e80eb77e4daa77deab31504187154514691814e6c13f5e87d8db225ee15e776c8c1d03f64adcc62fb91ff52d942
SSDEEP

49152:k05czfx+MZ5oqTGOFDyhFufVjyFT/28N9L7jE8usH:kIczfX6mjFtfV/8NNd

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

NFWCHK.exe

pid process

4360 NFWCHK.exe

pid	process
4360	NFWCHK.exe

Modifies Control Panel 1 IoCs

evasion

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\MuiCached	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

pid process

1664 d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
1664 d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

pid	process
1664	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
1664	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

description	pid	process	target process
PID 1664 wrote to memory of 4360	1664	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe	NFWCHK.exe
PID 1664 wrote to memory of 4360	1664	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe	NFWCHK.exe

C:\Users\Admin\AppData\Local\Temp\d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe"
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664

C:\Users\Public\Documents\Wondershare\NFWCHK.exe
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
2⤵
- Executes dropped EXE
PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Filesize
555B

MD5
f7067b2c572189c653a18bcfd1339932

SHA1
3975e25a29f88b63c834ad6c09c4e7c4f527df7e

SHA256
437aec472297b4db7283af0d85976eefff46cd7b4b5535de3e4372957f5369db

SHA512
e6074fd44e92004560dda467f9ab86cce59f3018ca42273769d747c8dd900d94e1c5046f0c19f6da95b6e189db57a17e97cf6611d660a5a23c96c49264202082

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Filesize
3KB

MD5
e985a9fbd389f18568f68cc2281df150

SHA1
45ee51d406cd1dda859087ccf5c658afebfbb7c7

SHA256
b254575cc6fd2afaf713d0858c63714de0669e8fef4ea2c41bb5896cc7ac7024

SHA512
301b058cb13ab50c5aa37089f7cd7513039030bd2d430276aa37fd228273c0c71f721a3ae73d135242f01414b46cd8c31834ea3077e496ce8684528114f44e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Filesize
7KB

MD5
03b46ff52ba26ce899a694ce23467b9b

SHA1
2128308f90202424bff79b21e2ad8bc7d95442dc

SHA256
395769a315a438304a2380d688c9c40cc9f31432deb65020db199c8d29ca08ed

SHA512
681843734eaa6d35d0dac590a6ba38c6228cc2de14b3732d05ff550d80cd08d191b91a980bff0c1b772827739d93f0037f6d0da325577f1519d1477699029600

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config
Filesize
223B

MD5
5babf2a106c883a8e216f768db99ad51

SHA1
f39e84a226dbf563ba983c6f352e68d561523c8e

SHA256
9e676a617eb0d0535ac05a67c0ae0c0e12d4e998ab55ac786a031bfc25e28300

SHA512
d4596b0aafe03673083eef12f01413b139940269255d10256cf535853225348752499325a5def803fa1189e639f4a2966a0fbb18e32fe8d27e11c81c9e19a0bb

Download Submit
memory/4360-1151-0x00007FFE57C05000-0x00007FFE57C06000-memory.dmp

Filesize
4KB

Download
memory/4360-1152-0x000000001B7A0000-0x000000001B7C4000-memory.dmp

Filesize
144KB

Download
memory/4360-1153-0x000000001B7D0000-0x000000001B7E8000-memory.dmp

Filesize
96KB

Download
memory/4360-1154-0x00007FFE57950000-0x00007FFE582F1000-memory.dmp

Filesize
9.6MB

Download
memory/4360-1155-0x000000001B810000-0x000000001B830000-memory.dmp

Filesize
128KB

Download
memory/4360-1156-0x00007FFE57950000-0x00007FFE582F1000-memory.dmp

Filesize
9.6MB

Download
memory/4360-1157-0x000000001B830000-0x000000001BB3E000-memory.dmp

Filesize
3.1MB

Download
memory/4360-1158-0x000000001BFF0000-0x000000001C039000-memory.dmp

Filesize
292KB

Download
memory/4360-1159-0x000000001C0B0000-0x000000001C112000-memory.dmp

Filesize
392KB

Download
memory/4360-1160-0x000000001C5F0000-0x000000001CABE000-memory.dmp

Filesize
4.8MB

Download
memory/4360-1161-0x000000001CB60000-0x000000001CBFC000-memory.dmp

Filesize
624KB

Download
memory/4360-1162-0x000000001BF80000-0x000000001BF88000-memory.dmp

Filesize
32KB

Download
memory/4360-1163-0x000000001D030000-0x000000001D06E000-memory.dmp

Filesize
248KB

Download
memory/4360-1165-0x00007FFE57950000-0x00007FFE582F1000-memory.dmp

Filesize
9.6MB

Download