e406369a5f04fc538b8e0eee5a39528743e7302e38f0b0d676c9e31b7f8db012

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe
Size

205KB
MD5

5af764c85f71fce63423a778d7f16520
SHA1

71bbc94232cb211e643e553dd6e29cd228c10264
SHA256

e406369a5f04fc538b8e0eee5a39528743e7302e38f0b0d676c9e31b7f8db012
SHA512

8185a3e8c07c436b5d366923464284c4b07658faec4f5f0f104d5b3ccd9edbd108d12a7ae1bf1fcc1a2e90bb9979ac14c6c9daddc48b2d888301c89d8378084a
SSDEEP

6144:fuFEsBvYCU/yG3D+i+AbKzLxRa78Gh8Bc9ifp79W:fqp6yG3DGA+vxRa78Gh8Bc9iB74

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4444	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4444	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4084	1396	WerFault.exe	82
1680	4444	WerFault.exe	87
3088	4444	WerFault.exe	87
4656	4444	WerFault.exe	87
4412	4444	WerFault.exe	87
648	4444	WerFault.exe	87
4784	4444	WerFault.exe	87

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1396	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4444	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4444	1396	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe	87
PID 1396 wrote to memory of 4444	1396	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe	87
PID 1396 wrote to memory of 4444	1396	5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 384
  2⤵
  - Program crash
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 352
    3⤵
    - Program crash
    PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 768
    3⤵
    - Program crash
    PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 808
    3⤵
    - Program crash
    PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 776
    3⤵
    - Program crash
    PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 812
    3⤵
    - Program crash
    PID:648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 796
    3⤵
    - Program crash
    PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1396 -ip 1396
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4444 -ip 4444
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4444 -ip 4444
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4444 -ip 4444
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4444 -ip 4444
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4444 -ip 4444
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4444 -ip 4444
1⤵
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5af764c85f71fce63423a778d7f16520_NeikiAnalytics.exe

Filesize
205KB

MD5
b52eb115838b3c2a97d27bc03b3dbf5f

SHA1
06f50ee111936bd1f00add7b8a124d5951f0b018

SHA256
645457e42cffb686ba2909d0a5372f5a7f714908993f3e89d2931ae715f7fb53

SHA512
fc976384cfd5e3be186cae462f0a7cb770520a8adb0d8f774ddb2cf6310490d645e1b5ba03b4bacce6a90ed92faa1634e412d114563f0bfe25f9d4d0ddd98090

Download Submit
memory/1396-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1396-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-8-0x00000000014B0000-0x00000000014F1000-memory.dmp

Filesize
260KB

Download
memory/4444-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download