Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:20
Static task
static1
Behavioral task
behavioral1
Sample
0565024f462161779975556e13db4ec0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0565024f462161779975556e13db4ec0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
0565024f462161779975556e13db4ec0_NeikiAnalytics.exe
-
Size
34KB
-
MD5
0565024f462161779975556e13db4ec0
-
SHA1
0b152b29ccfa2fbcfd1bf8191f999453ca8beac7
-
SHA256
3d8b4d611bbb9a1f0fae0b0031553f3e2b3741bcb45e775e413548531defb20c
-
SHA512
27cef898729596769463ad471aedebbf542e05cb946ae5ed25c4cec4726b4435d7ca790a470ea009d525f883ae9914f6514d2edccfea5253ab181ed1816082a2
-
SSDEEP
768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhi:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYC
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
microsofthelp.exepid process 2172 microsofthelp.exe -
Executes dropped EXE 1 IoCs
Processes:
microsofthelp.exepid process 2172 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0565024f462161779975556e13db4ec0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 0565024f462161779975556e13db4ec0_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
0565024f462161779975556e13db4ec0_NeikiAnalytics.exedescription ioc process File created C:\Windows\microsofthelp.exe 0565024f462161779975556e13db4ec0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0565024f462161779975556e13db4ec0_NeikiAnalytics.exedescription pid process target process PID 1828 wrote to memory of 2172 1828 0565024f462161779975556e13db4ec0_NeikiAnalytics.exe microsofthelp.exe PID 1828 wrote to memory of 2172 1828 0565024f462161779975556e13db4ec0_NeikiAnalytics.exe microsofthelp.exe PID 1828 wrote to memory of 2172 1828 0565024f462161779975556e13db4ec0_NeikiAnalytics.exe microsofthelp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0565024f462161779975556e13db4ec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0565024f462161779975556e13db4ec0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:2172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD524d389d406013b0523395fcc3b8fb8d1
SHA11f9c8a449d415be60de54ae5ef070d2c93e586a2
SHA256e1ec6ad94ec5da2a3b42b66c6535c9a46c0e9c79a5d5e1d2d0b25c3643ef8395
SHA512634c9fc6711bbd7b4c6df64964cfc41d8058660e135984703dda2eb85c28c6f95459b89ef03d8eb2a3637c6f0fd74b5694b72061c20050fd430768d45897dbb2