Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 22:37
Behavioral task
behavioral1
Sample
4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
4dd9c6d50217d4893b05fff2a6419ee0
-
SHA1
c9998e27195a41c555078228a6fc44862ee55046
-
SHA256
e867e8889d0359cbd0d14041c172c247a2c08c67d3c704c9a4001b67542fb236
-
SHA512
6fcbf45dfcc5f179c0bf53e2c07e310b3e6def9e02df9302726a3b7ce33651a020c5bc3f5f52fc7fec2b2d6316028a8e467ed46c7c4b0fe5fe24bd3668c38164
-
SSDEEP
1536:PcHU+vcfDtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsuZ9dPBU22ELLRtisZ0k:HecfDtdgI2MyzNORQtOflIwoHNV2XBFA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2288 ghsdtd.exe -
Loads dropped DLL 1 IoCs
pid Process 2940 4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x000b000000015ca5-11.dat upx behavioral1/memory/2288-15-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2940 4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe 2288 ghsdtd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2288 2940 4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe 28 PID 2940 wrote to memory of 2288 2940 4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe 28 PID 2940 wrote to memory of 2288 2940 4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe 28 PID 2940 wrote to memory of 2288 2940 4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4dd9c6d50217d4893b05fff2a6419ee0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\ghsdtd.exe"C:\Users\Admin\AppData\Local\Temp\ghsdtd.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5dab00cd3357acddf5c3b76e4fedc5e31
SHA1468bb7464f359bddc69521442427a1085b45286a
SHA256ac1e64a65ccaa52059ae48433c23f56ffcc09df933546b9995ab84380dea9822
SHA512cdcedd9b4308e3becd287a5ec7ef1b067336edfc2b310873ca2131e598f37e7fa39be25cd717972009b51d29c7f8463806ab957b545a8d12da57aeb69275beb3