Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe
-
Size
133KB
-
MD5
395390eb911b7c8f391b4b5f35648bb0
-
SHA1
330ad09959553c2d3fd211cad2d013f930ce12c1
-
SHA256
0082ca7ba56b1846ed408ad4c123afc4d69e3aba190767b501dce157ad0d68ce
-
SHA512
da252995115c17966f19f3eacc441df6b2ea0e55a2f372d45bfb0c05997cc5ab20becf63eecd3fb3c5635da1c3794fc988c198515321a454047e888512dc1209
-
SSDEEP
3072:KEboFVlGAvwsgbpvYfMTc72L10fPsout6nnn:pBzsgbpvnTcyOPsoS6nnn
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1932 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2780 KVEIF.jpg -
Loads dropped DLL 4 IoCs
pid Process 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1932 svchost.exe 2780 KVEIF.jpg 2032 svchost.exe -
resource yara_rule behavioral2/memory/1396-13-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-11-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-10-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-7-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-33-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-32-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-31-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-29-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-27-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-25-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-23-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-21-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-19-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-17-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-15-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-6-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-3-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1396-2-0x00000000009A0000-0x00000000009F5000-memory.dmp upx behavioral2/memory/1932-107-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-115-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-121-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-131-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-129-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-127-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-125-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-123-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-119-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-117-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-113-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-111-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-109-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-105-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx behavioral2/memory/1932-104-0x0000000000CB0000-0x0000000000D05000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kernel64.dll 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\kernel64.dll 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1396 set thread context of 1932 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 88 PID 2780 set thread context of 2032 2780 KVEIF.jpg 93 -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFs5.ini svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIF.jpg 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFmain.ini 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\$$.tmp svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\FKC.WYA KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFss1.ini 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1F\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\1D11D1F123.IMD KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\FKC.WYA svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFs5.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIF.jpg 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFmain.ini 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\FKC.WYA 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFs1.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\1D11D1F123.IMD svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1F\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\KVEIFs5.ini KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\ok.txt 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\FKC.WYA svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1F\1D11D1F123.IMD svchost.exe File created C:\Program Files\Common Files\Microsoft\1D11D1F\KVEIF.jpg svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\web\606C646364636479.tmp 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe File opened for modification C:\Windows\web\606C646364636479.tmp 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 2780 KVEIF.jpg 2780 KVEIF.jpg 2780 KVEIF.jpg 2780 KVEIF.jpg 2780 KVEIF.jpg 2780 KVEIF.jpg -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe Token: SeDebugPrivilege 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe Token: SeDebugPrivilege 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe Token: SeDebugPrivilege 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe Token: SeDebugPrivilege 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2780 KVEIF.jpg Token: SeDebugPrivilege 2780 KVEIF.jpg Token: SeDebugPrivilege 2780 KVEIF.jpg Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 2032 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1396 wrote to memory of 1932 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 88 PID 1396 wrote to memory of 1932 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 88 PID 1396 wrote to memory of 1932 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 88 PID 1396 wrote to memory of 1932 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 88 PID 1396 wrote to memory of 1932 1396 395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe 88 PID 2692 wrote to memory of 2780 2692 cmd.exe 92 PID 2692 wrote to memory of 2780 2692 cmd.exe 92 PID 2692 wrote to memory of 2780 2692 cmd.exe 92 PID 2780 wrote to memory of 2032 2780 KVEIF.jpg 93 PID 2780 wrote to memory of 2032 2780 KVEIF.jpg 93 PID 2780 wrote to memory of 2032 2780 KVEIF.jpg 93 PID 2780 wrote to memory of 2032 2780 KVEIF.jpg 93 PID 2780 wrote to memory of 2032 2780 KVEIF.jpg 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\395390eb911b7c8f391b4b5f35648bb0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530475D474A422F565840 02⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\system32\cmd.execmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530475D474A422F5658401⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files\Common Files\Microsoft\1D11D1F\KVEIF.jpg"C:\Program Files\Common Files\Microsoft\1D11D1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530475D474A422F5658402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530475D474A422F565840 03⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5acbcc5f38150e392b72886cfda620bcf
SHA1cf1b54b5ebbcbd2f82e0cf5274b100eb9a683503
SHA25616c20a6ccb5e11e9b7c08e4867f958816b59bafe1ecffd59a0cccd3a2a09b8dc
SHA5125a10e3311878b296f9339aba0767c3de72bf7085bc4c2348e324f595da9244a2f5c2a5129e260a006fe96954a3cfbf1d710e773cebfbefc83dfa5e626a9582ff
-
Filesize
133KB
MD5f29a3795a3823c84a68f49c07f154e0c
SHA1945e09692919fca492d346e0cd637e20b82b5e07
SHA25648a6f110db852bbad8e90e1a6f1ba8801fc43807269ffed9693a2ea89b1ce196
SHA512e7e28b5a615b20d3d7164d8913134280d30b2da2620953c87ba2ead88a2e4da6a222a09b334984a18c3abfb9bd93cfad502ed5d0e7608c36363f815b233f88dd
-
Filesize
22B
MD5930acf89790980bda3854f8bd8dc44d6
SHA14033478772bd5b31cdbf85187ad30eb03a560f33
SHA25634158e7ba9674f6eb03866767791fb29663241342a304cbc1286bdaf049269a6
SHA51287752859deee77287cf49d0f54f92dee94f49b2ef3c4fd76ee0b573f1cd73b3b9b472ce4f83e8ae11a8b71aa1c0a802c72b87f7fd940a6b3ddce4d85ab68b7b8
-
Filesize
87B
MD5743deb3c2b188911553d07d1282347eb
SHA19cc3398711b1c75754a910f5a6865f76c0e9b97c
SHA2565b96c6f8ff7cce851c4c467a88a60087785fde5d6edc2ed87cf8eaf8beaca813
SHA5127221b294f94f949d92ba2f5cfea822a51b9a867dd5d51ee8687fc816499cc45956826c1de5e3b20c2410fd33248c6697a975934cf70b739d1500faa0c0e46935
-
Filesize
133KB
MD5c90e535c9293714aaa81a145fdb4af2f
SHA188ed4b3f5f9b688818f827de48fd25ac176bda22
SHA2560f9e351400bd21cea9ab4c1896e0599c8013357cac57e4a7afbaf52bd28b5367
SHA5124692d6bff208719a3076a7100e15032e18b4254b5d072222736687caffb8e72315e6d1062e86c0598a6e0151b8d8c54d1920271731bdf52340f00345cec2434b
-
Filesize
1KB
MD58a86679b1616c16a5e47802a14b84102
SHA193c1f8f9de1db167e0b7a643775f487a5f09c197
SHA256d52794e0191d995cc4e34fd9a2aa97089cd35db1267bbad51b659d632d3d82a6
SHA51237d681a856fd7582337002bf04d7ac2a599201e957c95e76bcb90341906b70a50c9b30beca12219b643b88de8b0fa2d91102fd7870f89cc55a3573cf8ee8ebb4
-
Filesize
625KB
MD5eccf28d7e5ccec24119b88edd160f8f4
SHA198509587a3d37a20b56b50fd57f823a1691a034c
SHA256820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
-
Filesize
108KB
MD5f697e0c5c1d34f00d1700d6d549d4811
SHA1f50a99377a7419185fc269bb4d12954ca42b8589
SHA2561eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202
