Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 03:40
Static task
static1
Behavioral task
behavioral1
Sample
9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe
-
Size
586KB
-
MD5
9bf58aacf98e45793bc86b9f17c50bc0
-
SHA1
b58102042fa864e7a436ed02627299acc9257beb
-
SHA256
56fee759850748db989cb83993f61b54adeaf72ae1833d7ebca3d70b1236d781
-
SHA512
f4680bc94326f701b47a8de7cbe6e720d42616a9704b1bbc29077a5d1d14d54b14ef76e508edb2859af9f38e6bb016a1aafeaa083b0c53646a3ce093d38d4a49
-
SSDEEP
12288:5plrVbDdQaqdS/ofraFErH8uB2Wm0gXsNr5FU:7xRQ+Fucuvm0os
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 704 Windows.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\existing\Windows.exe 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 704 Windows.exe 704 Windows.exe 704 Windows.exe 704 Windows.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3256 wrote to memory of 704 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 82 PID 3256 wrote to memory of 704 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 82 PID 3256 wrote to memory of 704 3256 9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9bf58aacf98e45793bc86b9f17c50bc0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Program Files\existing\Windows.exe"C:\Program Files\existing\Windows.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:704
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
586KB
MD513617bfcf8a7cd2349458688a5561381
SHA1602089bb9acd67a2ed5c54280be6805634bbd2ff
SHA25668ef89efa0ff8866ee741ff7f145035821116e381b5a348470553de702335bc6
SHA5124662a5fe5e299bba45aee18d17596d72d87fe7fa30921d8b1c1ce67026e71a0675f7cf3ce609886574f2a65da550ea1a94babbf9e1992b87de9acc65c35e1c22