Analysis
-
max time kernel
140s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 09:57
Static task
static1
Behavioral task
behavioral1
Sample
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe
-
Size
255KB
-
MD5
12068b3c709689a76e7432ded539ab7c
-
SHA1
579515827d3db8f7a6c7fda2a3d68274538d7179
-
SHA256
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a
-
SHA512
842b4b4adb51a8ba20748bd777cd413cb1f1254ae10f7f372b10374b6afe360e8e1eebf4ffccc524ba5b3d15280d2b408d6bb36f9b6a617c194784ac248697db
-
SSDEEP
6144:aehwWf8SYTepVWgv2YwRh9SDXgcj36+iMZ40:fhwWf8ApURVhiXgcb6Mq0
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.65.64
-
url_path
/advdlc.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3528 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 1572 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 2740 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 4008 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 712 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 4480 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 4660 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 4028 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe 1380 2920 WerFault.exe 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5116 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 5116 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.execmd.exedescription pid process target process PID 2920 wrote to memory of 2752 2920 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe cmd.exe PID 2920 wrote to memory of 2752 2920 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe cmd.exe PID 2920 wrote to memory of 2752 2920 3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe cmd.exe PID 2752 wrote to memory of 5116 2752 cmd.exe taskkill.exe PID 2752 wrote to memory of 5116 2752 cmd.exe taskkill.exe PID 2752 wrote to memory of 5116 2752 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 7482⤵
- Program crash
PID:3528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 6122⤵
- Program crash
PID:1572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 6122⤵
- Program crash
PID:2740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 7762⤵
- Program crash
PID:4008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 9042⤵
- Program crash
PID:712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 9802⤵
- Program crash
PID:4480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 11522⤵
- Program crash
PID:4660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 13562⤵
- Program crash
PID:4028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3153c3109e15bad00cb9d96580ab612fa553c6c15d248dddbffc3f6f7930639a_NeikiAnalytics.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 13202⤵
- Program crash
PID:1380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2920 -ip 29201⤵PID:4488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2920 -ip 29201⤵PID:4360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2920 -ip 29201⤵PID:3392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2920 -ip 29201⤵PID:1156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2920 -ip 29201⤵PID:4476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2920 -ip 29201⤵PID:4928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2920 -ip 29201⤵PID:2092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2920 -ip 29201⤵PID:4868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2920 -ip 29201⤵PID:2588