Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 08:40
Behavioral task
behavioral1
Sample
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
721b758a83caa37ad1a51b55f41ec1f0
-
SHA1
90a497ae13229c029868c3b89c9519f7d652e11c
-
SHA256
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
-
SHA512
cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwqEK9o:E5aIwC+Agr6S/FEAGsjiII8
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x00070000000233fb-22.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/2576-15-0x0000000002C50000-0x0000000002C79000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe Token: SeTcbPrivilege 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2576 wrote to memory of 5104 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 83 PID 2576 wrote to memory of 5104 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 83 PID 2576 wrote to memory of 5104 2576 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 83 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 5104 wrote to memory of 4956 5104 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 84 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 1304 wrote to memory of 4892 1304 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 101 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 PID 4428 wrote to memory of 2544 4428 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 109 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4956
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4892
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe
Filesize1.2MB
MD5721b758a83caa37ad1a51b55f41ec1f0
SHA190a497ae13229c029868c3b89c9519f7d652e11c
SHA256240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
SHA512cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
Filesize
59KB
MD5a516b3423fada769bdc50e381740c1ba
SHA16921c699d555811079666f29642d4bcb53d14dbd
SHA25604e143163368893d90d221802e295f8f61f89b392f761fd2f7f9af033e6a653d
SHA512e6489d3969a03a48ff8e49a88b098da4fcca19c4220191cc47c8f8e43d2d565e7142f4bf0b83c901c5d12e97138cd6fad7c58fbf9d8577bb0a665059618109b5