Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
16/05/2024, 22:01
General
-
Target
42e04b696c67b5e03c383b7c31b25d30_NeikiAnalytics.exe
-
Size
320KB
-
MD5
42e04b696c67b5e03c383b7c31b25d30
-
SHA1
1b11067f4e5ea58acfcbabbac4bbea1d7e0b96a5
-
SHA256
b8f2019686f681f076462e42ca42d4cdf38dda588eaa512771f11496e97adfe0
-
SHA512
bfc4a2ad889973cb7f88edc81a2b5f19fba1bdbb64f9f62a16361794a4987de075672bdf71e290d47ee8e9a8ee59703b1767af8a05e94e57087cd43704e4f9fc
-
SSDEEP
6144:k5GgJgBhFkv01VcNliLcKQ8tqHz3I/CPX9aLisM+NeOV40saiigCX:2GtJ1VK8LcJ8tqHz+CPX9aLisvNeOVQ0
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e04b696c67b5e03c383b7c31b25d30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\42e04b696c67b5e03c383b7c31b25d30_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\42e04b696c67b5e03c383b7c31b25d30_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\42e04b696c67b5e03c383b7c31b25d30_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD5f865902f6ed484334eb62f5261e02bf0
SHA13fba02483ac7fd40be9be83b969c36fe41ac1f00
SHA2567ba01c1c0d298ac3d534a59f490c76a2e099c01679902fb05c21e4e2ad2e77b3
SHA512135bac4460b7cf101337db55651354f6243fe232d1750e2e82edd7e7f15994b3a88b739395e5a5ae3fa3ecf542ca8c8da2d85e98dcce5e9b326be888a93ada5f
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
104KB