Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
465c90cc4133fd9175a93296f6f241f0
-
SHA1
f078ab94a2cdced9163ef928b655a69335bcb4e6
-
SHA256
130f291fce97ac4ee85e3c128a401ce4df46ad6f78816752757bc56a451fcc5b
-
SHA512
9a7e619bfdf6feb8bbae8a790ece907b35b7b49523901ce70ff7b6e93b606f6d44b9d19542ab114e1fbc9d44f1be9120c7aa08666af95745f9515d917a56be63
-
SSDEEP
1536:zvpySxR4aEN4w0CP3YwhOQA8AkqUhMb2nuy5wgIP0CSJ+5yMB8GMGlZ5G:zvzxcpWJGdqU7uy5w9WMyMN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4636 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4556 5064 465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe 83 PID 5064 wrote to memory of 4556 5064 465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe 83 PID 5064 wrote to memory of 4556 5064 465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe 83 PID 4556 wrote to memory of 4636 4556 cmd.exe 84 PID 4556 wrote to memory of 4636 4556 cmd.exe 84 PID 4556 wrote to memory of 4636 4556 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\465c90cc4133fd9175a93296f6f241f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exePID:4556
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:4636
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD54c59cdbd3c427ba159fde6a751d64992
SHA15247a2f1f0ba9bcc4d58fa1cf4a54d2528b4604a
SHA25624478adebd623f409d3ad081476602bff86017ee4f7d32188f482cbefdc1b158
SHA512ab3e18360a71af5d9129c63148e492ab60aa819df3b75a88b5c8966c09065eb179b0497c100cfa284f41ddaa79b8051593c9a5fa1b435b9f8f5f4b5a465cc801