Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:23
Behavioral task
behavioral1
Sample
4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exe
-
Size
3.5MB
-
MD5
4b0f82056e09b6875b8d6195b2808a20
-
SHA1
46b5679b02b66c43a73300f8c74f1181716064d7
-
SHA256
8bc6f3ea946eb094a8468879e0507f8d3a084b2d05fd5ea0e5b1470ae866fb0f
-
SHA512
bcc9854eccb0f4cbdb3331c8e8018e671188da9c08ec127c2878295239ab4f8daa44920497a80c187d178c05b7f60dc1fddd130fdae17e0c773c83172a9506f5
-
SSDEEP
98304:llAzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz+:lazzzzzzzzzzzzzzzzzzzzzzzzzzzzzG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svrwsc.exepid process 4480 svrwsc.exe -
Processes:
resource yara_rule behavioral2/memory/4540-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-6-0x0000000000400000-0x000000000042A000-memory.dmp upx C:\Windows\SysWOW64\svrwsc.exe upx -
Drops file in System32 directory 2 IoCs
Processes:
4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exesvrwsc.exedescription ioc process File created C:\Windows\SysWOW64\svrwsc.exe 4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b0f82056e09b6875b8d6195b2808a20_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
PID:4540
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4480
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD5758a4c879b5cd1ecb5c5fcd48441aca8
SHA1c62463dc779b9334e217cbdf3ca39061506b656b
SHA256cfcf46d3aca31670c99e27d7d6b029c8762ab909d2cc8189b45cdcff4edd16c9
SHA512d9712c4de2b3388b99ac71087da07bebc427701b665b92b013cd4b992ebd595538140b44b73ae5b73c54db44d585083cc7348ac61850f4e2998259dd96dfc49d