Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:15
Behavioral task
behavioral1
Sample
49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
49c49ed0fa6a63a211aeeb4568fe6e40
-
SHA1
78ae7378e616b132481bc5486d0dcc9d10013ce2
-
SHA256
57cd36a0d31a5fb6ba95da24a1ee93038ba54246fe3e359244289a7e7365fdc9
-
SHA512
3bc77fb413f0cbc99e7c0fa50c49b1fb4ca7d923038577918cb004d6e0a4e4fffc1fefb1ca64e84aae71816ca1a72d6c87b6846bd39734dc25990908a4036f0f
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlQvmp8RxAb5J6iHsl5TS4Opy:E5aIwC+Agr6StVEnmcKxYDvZThTS4B
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/3492-15-0x0000000002190000-0x00000000021B9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exepid process 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exedescription pid process Token: SeTcbPrivilege 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe Token: SeTcbPrivilege 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exepid process 3492 49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exedescription pid process target process PID 3492 wrote to memory of 1524 3492 49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe PID 3492 wrote to memory of 1524 3492 49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe PID 3492 wrote to memory of 1524 3492 49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 1524 wrote to memory of 2172 1524 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3052 wrote to memory of 3372 3052 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe PID 3636 wrote to memory of 1068 3636 49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49c49ed0fa6a63a211aeeb4568fe6e40_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\49c49ed0fa7a73a211aeeb4679fe7e40_NeikiAnalytict.exeFilesize
1.3MB
MD549c49ed0fa6a63a211aeeb4568fe6e40
SHA178ae7378e616b132481bc5486d0dcc9d10013ce2
SHA25657cd36a0d31a5fb6ba95da24a1ee93038ba54246fe3e359244289a7e7365fdc9
SHA5123bc77fb413f0cbc99e7c0fa50c49b1fb4ca7d923038577918cb004d6e0a4e4fffc1fefb1ca64e84aae71816ca1a72d6c87b6846bd39734dc25990908a4036f0f
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
48KB
MD5bd0566ef358fac8fd60d2b931eb9174e
SHA17088d343a9b21e993d146d208552403842650b85
SHA256b2d6dc4e885ea3a106db3636d4433e85bc2e8ed87927c16d0c4b1e2f80918b44
SHA512fdcb783411ba19190f30033abc3d006999d5683b7a782207c4301517c7402c50e5cfc7fdcc9842206ffa2e5be1bb1415053137f024e4a1054678477ec7519ac1
-
memory/1524-31-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-41-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/1524-33-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-36-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-26-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-53-0x0000000003120000-0x00000000033E9000-memory.dmpFilesize
2.8MB
-
memory/1524-27-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-34-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-35-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-52-0x0000000003060000-0x000000000311E000-memory.dmpFilesize
760KB
-
memory/1524-28-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-29-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-30-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-32-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/1524-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1524-37-0x0000000002030000-0x0000000002031000-memory.dmpFilesize
4KB
-
memory/2172-46-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2172-51-0x000001D672180000-0x000001D672181000-memory.dmpFilesize
4KB
-
memory/3052-60-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-65-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-73-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3052-72-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/3052-58-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-61-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-63-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-64-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-66-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-67-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-68-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-69-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-62-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3052-59-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/3492-2-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-10-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-13-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-15-0x0000000002190000-0x00000000021B9000-memory.dmpFilesize
164KB
-
memory/3492-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3492-11-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/3492-9-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-12-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-8-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-7-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-6-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-5-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-4-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-3-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3492-14-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB