Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:18
Static task
static1
Behavioral task
behavioral1
Sample
40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe
-
Size
666KB
-
MD5
40e74255e2f90ce56eb01d773cb44430
-
SHA1
570e9c660c5a443e3dadd72b96e8c638b29617c5
-
SHA256
7fbc12b655c7152aa2a5606966d5158e07f559570610f58822f14d5cd531bba0
-
SHA512
af5c433bfa29c3b1a3e6ad72df92fe5b3fb1b7e1ee55a98d46002eb5ba7ffaee2c7c525786aa9abe4b92cda9838dbf3d20000db71a56b7d969166fbcc86c1d67
-
SSDEEP
12288:uF0pei36RoX53sdDU7N++kuy6msWk6M87mHytLVx5iOB63ywXlyj5KSpuqhYUqar:uKpp362X53h7YkWkt3SRVx0KOySIE0us
Malware Config
Extracted
formbook
4.1
38gc
fgoz3kry51.asia
vanishingacthairremoval.com
onlinelearningsandbox.com
feluca-egypt.com
goforsourcing.com
hairmadeperfect.com
brockspaydayearners.com
vintagetoj.com
tjandthecampers.com
emkanelajiehes.com
bestundersinkwaterfilter.com
proatta777.com
satuslot.beauty
nicolesbodybutter.com
montecarlogallery.com
homeautomation.one
cx-n1.ink
spennys.casa
gaozgn.cfd
hakajimai.online
ghorshed95.com
writingmentor.pro
lyallpuronline.com
china-gb.net
realizare-site.net
welding-ceramics.com
5q72q.top
24hlondon.info
nequiapp.fun
td-group.net
bvrgu.top
cliffderksen.com
stusipad.com
echoeshopnet.shop
aayan-resume.com
buyingcentercleveland.com
wildstyle.nyc
wupdrld.top
wellnesswithpami.com
5ce3p.com
313bets.com
renzkaliloalio40.click
devlab.online
macgyverindustries.com
schuxue.fun
b3995.vip
wengweng.buzz
contactelec.biz
nbttaxes.com
doodlelite.com
rtke1r.cfd
xiemiav.vip
wikistr.com
velvetvortex.top
bestcryptominer.com
171wykehamrdwashington.com
mkhsk.com
notyoursahm.com
illumemgmt.com
finance-profil.com
sokepide.com
purchaseonline.store
subervisual.com
sirnote.com
citizens4daniellee.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2816-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exedescription pid process target process PID 4364 set thread context of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exepid process 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 2816 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 2816 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exedescription pid process target process PID 4364 wrote to memory of 2696 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2696 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2696 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe PID 4364 wrote to memory of 2816 4364 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe 40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\40e74255e2f90ce56eb01d773cb44430_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2816-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2816-14-0x0000000000E80000-0x00000000011CA000-memory.dmpFilesize
3.3MB
-
memory/4364-6-0x00000000054E0000-0x0000000005502000-memory.dmpFilesize
136KB
-
memory/4364-3-0x0000000005050000-0x00000000050E2000-memory.dmpFilesize
584KB
-
memory/4364-4-0x0000000004FD0000-0x0000000004FDA000-memory.dmpFilesize
40KB
-
memory/4364-5-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4364-0-0x00000000743FE000-0x00000000743FF000-memory.dmpFilesize
4KB
-
memory/4364-7-0x00000000054C0000-0x00000000054CC000-memory.dmpFilesize
48KB
-
memory/4364-8-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/4364-9-0x0000000006580000-0x00000000065F6000-memory.dmpFilesize
472KB
-
memory/4364-10-0x000000000B030000-0x000000000B0CC000-memory.dmpFilesize
624KB
-
memory/4364-2-0x0000000005560000-0x0000000005B04000-memory.dmpFilesize
5.6MB
-
memory/4364-13-0x00000000743F0000-0x0000000074BA0000-memory.dmpFilesize
7.7MB
-
memory/4364-1-0x0000000000560000-0x000000000060C000-memory.dmpFilesize
688KB