Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 19:20

General

  • Target

    0565024f462161779975556e13db4ec0_NeikiAnalytics.exe

  • Size

    34KB

  • MD5

    0565024f462161779975556e13db4ec0

  • SHA1

    0b152b29ccfa2fbcfd1bf8191f999453ca8beac7

  • SHA256

    3d8b4d611bbb9a1f0fae0b0031553f3e2b3741bcb45e775e413548531defb20c

  • SHA512

    27cef898729596769463ad471aedebbf542e05cb946ae5ed25c4cec4726b4435d7ca790a470ea009d525f883ae9914f6514d2edccfea5253ab181ed1816082a2

  • SSDEEP

    768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhi:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0565024f462161779975556e13db4ec0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0565024f462161779975556e13db4ec0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    34KB

    MD5

    24d389d406013b0523395fcc3b8fb8d1

    SHA1

    1f9c8a449d415be60de54ae5ef070d2c93e586a2

    SHA256

    e1ec6ad94ec5da2a3b42b66c6535c9a46c0e9c79a5d5e1d2d0b25c3643ef8395

    SHA512

    634c9fc6711bbd7b4c6df64964cfc41d8058660e135984703dda2eb85c28c6f95459b89ef03d8eb2a3637c6f0fd74b5694b72061c20050fd430768d45897dbb2

  • memory/1828-4-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/1828-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2172-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB