Analysis

  • max time kernel
    146s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    16-05-2024 12:03

General

  • Target

    ddbad8fe8363f66ad170ee6670051e90_NeikiAnalytics.exe

  • Size

    9.2MB

  • MD5

    ddbad8fe8363f66ad170ee6670051e90

  • SHA1

    ec2c9f5e777026f8d45a7e35b8090cbad349c1fd

  • SHA256

    91df833feb6fd98714b7f5902959ad88d5b0722dfee35bc89f34cc8e4df8ecad

  • SHA512

    963f598b4d4a77319b04761fb02f5d05d5f746b172852a334ba46998b1dea7fd2a8d8b682eda3fc503cf25029be387d435fd1395159914a6aecddaaf31ebb830

  • SSDEEP

    196608:yN3wT9nQji+kMr0YkXuGG1Wmnz5H69YHpIHc7IxBOxD:yN3wOe+VqXuTwMH69acxB

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddbad8fe8363f66ad170ee6670051e90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\ddbad8fe8363f66ad170ee6670051e90_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Local\Temp\ddbad8fe8363f66ad170ee6670051e90_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\ddbad8fe8363f66ad170ee6670051e90_NeikiAnalytics.exe"
      2⤵
      • Checks BIOS information in registry
      • Enumerates connected drives
      • Checks processor information in registry
      • Enumerates system info in registry
      PID:2580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1760-30-0x0000000005930000-0x00000000063E6000-memory.dmp

    Filesize

    10.7MB

  • memory/1760-2-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1760-3-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1760-1-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1760-5-0x0000000010000000-0x0000000010901000-memory.dmp

    Filesize

    9.0MB

  • memory/1760-4-0x0000000010000000-0x0000000010901000-memory.dmp

    Filesize

    9.0MB

  • memory/1760-23-0x0000000010000000-0x0000000010901000-memory.dmp

    Filesize

    9.0MB

  • memory/1760-0-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1760-28-0x0000000000400000-0x0000000000EB6000-memory.dmp

    Filesize

    10.7MB

  • memory/1760-29-0x0000000010000000-0x0000000010901000-memory.dmp

    Filesize

    9.0MB

  • memory/2580-33-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB

  • memory/2580-18-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-31-0x0000000000EAF000-0x0000000000EB6000-memory.dmp

    Filesize

    28KB

  • memory/2580-19-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2580-27-0x0000000000EC0000-0x0000000001153000-memory.dmp

    Filesize

    2.6MB

  • memory/2580-26-0x0000000000EC0000-0x0000000001153000-memory.dmp

    Filesize

    2.6MB

  • memory/2580-14-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-34-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB

  • memory/2580-35-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB

  • memory/2580-25-0x0000000000EC0000-0x0000000001153000-memory.dmp

    Filesize

    2.6MB

  • memory/2580-8-0x0000000000EC0000-0x0000000001153000-memory.dmp

    Filesize

    2.6MB

  • memory/2580-32-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB

  • memory/2580-17-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-16-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-15-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-13-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-21-0x0000000000EC0000-0x0000000001153000-memory.dmp

    Filesize

    2.6MB

  • memory/2580-12-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-11-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-10-0x0000000001160000-0x0000000001944000-memory.dmp

    Filesize

    7.9MB

  • memory/2580-37-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB

  • memory/2580-38-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB

  • memory/2580-40-0x0000000000EC0000-0x0000000001153000-memory.dmp

    Filesize

    2.6MB

  • memory/2580-41-0x0000000000400000-0x0000000000CDD000-memory.dmp

    Filesize

    8.9MB