4ef1b1ca21e56a0aa1c0cbf7b9a28f1a4788119b09f1d59487740e8fca3f5bf5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe
Size

303KB
MD5

b9af86f9cdaea5f4f701d061590207c0
SHA1

da61a0a6b16ac111c8c36698db9f772da70d0df7
SHA256

4ef1b1ca21e56a0aa1c0cbf7b9a28f1a4788119b09f1d59487740e8fca3f5bf5
SHA512

0d6ea879cddc6a7572fa85b1f4d8ec33aeae52beeca926ecb1ed9010c48b84ec1832bc5f0280352497f6eea3444654e581b9dfc31658d9b5757bcef28ec12cb0
SSDEEP

6144:QI/bCjsMt44+0hxPkK57EqPQUQ1YJBh6jTFRbf0eN0W7cyqCxSngmMBqfycN:QI/bCoMt4MPPf21gBh6XFRbf0ez0npM4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4380	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4380	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1304	4528	WerFault.exe	82
4732	4380	WerFault.exe	88
4676	4380	WerFault.exe	88
2736	4380	WerFault.exe	88
1508	4380	WerFault.exe	88
1160	4380	WerFault.exe	88
1260	4380	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4528	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4380	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4380	4528	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe	88
PID 4528 wrote to memory of 4380	4528	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe	88
PID 4528 wrote to memory of 4380	4528	b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 384
  2⤵
  - Program crash
  PID:1304
- C:\Users\Admin\AppData\Local\Temp\b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 352
    3⤵
    - Program crash
    PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 768
    3⤵
    - Program crash
    PID:4676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 808
    3⤵
    - Program crash
    PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 776
    3⤵
    - Program crash
    PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 796
    3⤵
    - Program crash
    PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 592
    3⤵
    - Program crash
    PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4528 -ip 4528
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4380 -ip 4380
1⤵
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4380 -ip 4380
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4380 -ip 4380
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4380 -ip 4380
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4380 -ip 4380
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4380 -ip 4380
1⤵
PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b9af86f9cdaea5f4f701d061590207c0_NeikiAnalytics.exe

Filesize
303KB

MD5
b437735f9b4f15173defbcbacfae5dbd

SHA1
77d4ad0e15a84de820865f23f39ca6958297647c

SHA256
3849266864b6685aea5e8298e9c2200b6fe60dac92ad625dba6d6d1ae045ae4f

SHA512
f3a84190f3c09d20de13a7cc3653532a89e0aae12bf206ba60c2b323da42f3f681c1798db950d4f79cfbd6d4145d29cc7a2fc8b97efb2e41460b72af16907426

Download Submit
memory/4380-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4380-8-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/4380-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4528-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4528-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download