Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 05:55
Static task
static1
Behavioral task
behavioral1
Sample
bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe
-
Size
45KB
-
MD5
bebd7c90d3c6e7441357fa81d19bae90
-
SHA1
99d01f9f085610f3b7e964d679a61379e28d7367
-
SHA256
80b226f3c2a5571daf8301661277a25899fc6622b8ff4e0b1ddea99821ae6907
-
SHA512
f545b5d8e4181891647dd9a44a207632e1369772ea24786d9360c4b744475387b79805b59fd166a7be13db453837401e18b7bb7306dbadf08749864570e1d112
-
SSDEEP
768:zIP5WOMVs4PSV06ymNNC6S7Cm1n2OBGRIWNSE77NPQ1TTGfGYy6KL:zI0OGrOy6NvSpMZVQ1JQKL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2472 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 1712 bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe 1712 bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre-09\bin\UF bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe File created C:\Program Files (x86)\Java\jre-09\bin\jusched.exe bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Java\jre-09\bin\jusched.exe bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe 2472 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2472 1712 bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2472 1712 bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2472 1712 bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2472 1712 bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bebd7c90d3c6e7441357fa81d19bae90_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD51fc3c72a292ed8047d163ebb22c90969
SHA10a78d555786c63dba5fdc9af5570bab18ec9c58e
SHA2560a8782b2e4f300d0eb4722ad18684bb4632379634c13e20575e0fa64d6cfa985
SHA512222391ef29ec1f1708b8709e082ef0e2ea991632180478bbfcd71e3e4bb3abbadfde3ecb5ba9594e7b1dd5557c5b771f298a3922113921770958253837dca1c5