Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:44
Static task
static1
Behavioral task
behavioral1
Sample
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe
-
Size
320KB
-
MD5
4f8286172fb9344af6a732bdfae3b6f0
-
SHA1
56d0d408443aa12b183086a9b263d9b37195cb95
-
SHA256
84950f4916828dd90af86ce54cf4319777bbad24ed10fc60f24cef544a584e4a
-
SHA512
87bd791f561a9a00c259301a9708d47af1c879cbcf2847599bf5bd4979805cd93bd63caf47a78e9492fbd0abee9fc78555e526d715cc4446f79f694970bd53cd
-
SSDEEP
6144:a2vfy7/6n4/pSgCi7nK6UkB53BDu0W7cyqCxSngmMBqfycuPbUl0i5j:aYyAYSgp7X53p80npM4dl0s
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exepid process 4484 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exepid process 4484 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe -
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4676 4888 WerFault.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 1464 4484 WerFault.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 2740 4484 WerFault.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 4912 4484 WerFault.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 1392 4484 WerFault.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exepid process 4888 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exepid process 4484 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exedescription pid process target process PID 4888 wrote to memory of 4484 4888 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe PID 4888 wrote to memory of 4484 4888 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe PID 4888 wrote to memory of 4484 4888 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe 4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 3562⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 3523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 7683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 8083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 8163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4888 -ip 48881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4484 -ip 44841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4484 -ip 44841⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4484 -ip 44841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4f8286172fb9344af6a732bdfae3b6f0_NeikiAnalytics.exeFilesize
320KB
MD5e460af89f60781073a39840bb66fed1c
SHA1bcc9c6a6664ae5f41244bc1525504cf7f93c0365
SHA256c76623b49f3ee111b22060795bf17253d3f66ba73bdfd345e71bf6be29bf0240
SHA5122c345dcf97f7f5898a0452f69eebcd10ebfa20e4565e8e0b4c64266cc72e4812936271289c28e27b48421f827c44137211ba3963fcfe9b5cb36df038c5199148
-
memory/4484-7-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4484-8-0x00000000014A0000-0x00000000014DC000-memory.dmpFilesize
240KB
-
memory/4484-9-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4888-0-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4888-6-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB