df4e34254ff0a26eef44beebb532b45a116f159a44a0dea1dff5b2762f3d0e9e

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe
Size

4.0MB
MD5

af56684ac43b4b7932da4132cf2cac20
SHA1

f2bbfef2aee1b1d876ef8eb1c3fb535618d815d9
SHA256

df4e34254ff0a26eef44beebb532b45a116f159a44a0dea1dff5b2762f3d0e9e
SHA512

6c35d7ce3677c2b379735fc63df27ff2d8fda5b96f3d2258aa16db11b6741d180423c36dd1406d92f2aac898e1ab35460af2a2657c261cb2b1cc2dd231d2fff5
SSDEEP

49152:MZ12je6hR4/4xa9Ggwbq4TTC8uk2bC73Cmghbq4TTbumQL3ewMxHaCghbq4TTC8m:MZ12M/4U8hT+7kyhTndQL3ePehT+7D

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2896	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2896	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2884	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2896	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2884	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2896	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2896	2884	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 2896	2884	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 2896	2884	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 2896	2884	af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\af56684ac43b4b7932da4132cf2cac20_NeikiAnalytics.exe

Filesize
4.0MB

MD5
659a8ed35ef178da456493e64957dd29

SHA1
eac6bb946330e61dec1e8c910e70e27f104f7d50

SHA256
01013160edcc5e66e08aa5269f8b8ce7009c23d22b82907b76868d2e9dae0864

SHA512
5b7a5d7601eb1850ed3b279acdeb268b72946be02d97523700ecfcd4407967100fc728e84de641a8c64fc0401cfba6c853edd5953e8cf04a7cf309b1719165fc

Download Submit
memory/2884-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2884-6-0x0000000003710000-0x00000000037FF000-memory.dmp

Filesize
956KB

Download
memory/2884-8-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2896-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2896-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2896-17-0x0000000002E00000-0x0000000002EEF000-memory.dmp

Filesize
956KB

Download
memory/2896-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2896-39-0x000000000FEB0000-0x000000000FF53000-memory.dmp

Filesize
652KB

Download