Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
17/05/2024, 19:17
General
-
Target
1de4ba2dce409fe835e7076709841df0_NeikiAnalytics.exe
-
Size
190KB
-
MD5
1de4ba2dce409fe835e7076709841df0
-
SHA1
944e52325aab0eb2e3e731c0f6d39d7f0fe50e19
-
SHA256
b0cb59a42798935ab882ee99b12674b10cd1fa1afeca1cee1ea7b43ed17891cd
-
SHA512
5ff871f337e4c9216a57b7eeb9c7484c218869172b0aff636c3c089caba089218992048e6837e28d6ee6854322311e2584711e0bfc1481c972f39e7ca095adea
-
SSDEEP
3072:KDbHK0L3nV1JKR3o3Hj8xYiXWfLOJvis0tfAC0zDcIdF9Q6ynmmo0/QTKd4kvhl9:KDTF1JKBo3Hj8xLXWfLOIoBgYF9Qwme8
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de4ba2dce409fe835e7076709841df0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1de4ba2dce409fe835e7076709841df0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1de4ba2dce409fe835e7076709841df0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\1de4ba2dce409fe835e7076709841df0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190KB
MD5a99a6ce57d5ee2b08e5a08d2f64e8946
SHA1c7bbfb4c23e8c30a09215df904f08dd42547c45e
SHA256cdde32c49472f5a6469976f049eb81445cf71493939cc95ea42ff482a1cef18d
SHA512230814b0ed6a1e8f60234f069610e370f550563683c4263e22146456810d045bf4c96cec019ff50d926ecb53035988a02e6e7ba05f2a062f4c8a8c55e68640a9
-
Filesize
220KB
-
Filesize
104KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB