Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:04
Static task
static1
Behavioral task
behavioral1
Sample
0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe
-
Size
276KB
-
MD5
0171042d64375e892b00e341e6319d20
-
SHA1
7775c4bc882ebb3a815b080159a869d1ffad0005
-
SHA256
d4f8052c60cbcbe7eae1488b49217fcface8791da3d0c21d1c3228ae9789a83f
-
SHA512
809117b221603e221df805914a69fabe748cf87c0a164b60a8ce9a16a0d15c9ad1bde57388d9433cb8de9ce4d31e86bdf871526129e4685e16f39ca761df54cb
-
SSDEEP
6144:uHsVYT6bJzP8yjtm34v+7eOXlS5IVvgAN:gMYWbdBj5v+7h+IVr
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2944 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2572 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2572 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0171042d64375e892b00e341e6319d20_NeikiAnalytics.execmd.exedescription pid process target process PID 1708 wrote to memory of 2944 1708 0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe cmd.exe PID 1708 wrote to memory of 2944 1708 0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe cmd.exe PID 1708 wrote to memory of 2944 1708 0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe cmd.exe PID 1708 wrote to memory of 2944 1708 0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe cmd.exe PID 2944 wrote to memory of 2572 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 2572 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 2572 2944 cmd.exe taskkill.exe PID 2944 wrote to memory of 2572 2944 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "0171042d64375e892b00e341e6319d20_NeikiAnalytics.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-1-0x00000000020F0000-0x00000000021F0000-memory.dmpFilesize
1024KB
-
memory/1708-2-0x0000000000220000-0x000000000025C000-memory.dmpFilesize
240KB
-
memory/1708-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1708-9-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1708-8-0x0000000000220000-0x000000000025C000-memory.dmpFilesize
240KB
-
memory/1708-7-0x00000000020F0000-0x00000000021F0000-memory.dmpFilesize
1024KB
-
memory/1708-6-0x0000000000400000-0x0000000001F90000-memory.dmpFilesize
27.6MB