Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 23:38
General
-
Target
59a06761c0708e67d2cc04b03f85f2a0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
59a06761c0708e67d2cc04b03f85f2a0
-
SHA1
0b3629f9ec11a96b2368ea0720a6266b383f2f09
-
SHA256
e210714cf9ad0c8ce1abf38c9a941d0a87a9c79233966b23caf364c0d424b734
-
SHA512
738281fbddcee37fae3cc168a02780cbf4bf5f80713a686361b822f0125126b92751648ba6e9e8c9f108916b596c7ad29347e9996a6826d618a342205a83474f
-
SSDEEP
192:ObOzawOs81elJHsc45HcRZOgtSWcWaOT2QLrCqwgY04/CFxyNhoy5tm:ObLwOs8AHsc4pMfwIKQLrou4/CFsrdm
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59a06761c0708e67d2cc04b03f85f2a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\59a06761c0708e67d2cc04b03f85f2a0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C58675B-0545-475d-A744-9AF1A789E834}.exeC:\Windows\{0C58675B-0545-475d-A744-9AF1A789E834}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14DCB60A-D6CA-4274-BF3A-66EEB167770A}.exeC:\Windows\{14DCB60A-D6CA-4274-BF3A-66EEB167770A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E69F472D-233B-4c5a-8F9E-5774DB6A7D72}.exeC:\Windows\{E69F472D-233B-4c5a-8F9E-5774DB6A7D72}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB630DCB-5B2D-41db-ADD6-FA0D12921AA9}.exeC:\Windows\{DB630DCB-5B2D-41db-ADD6-FA0D12921AA9}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{138E5281-B04E-4f2f-B37F-D39D0E211A95}.exeC:\Windows\{138E5281-B04E-4f2f-B37F-D39D0E211A95}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16A31781-B95A-4791-B6B8-62AC3CF9F476}.exeC:\Windows\{16A31781-B95A-4791-B6B8-62AC3CF9F476}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF8BB187-43AA-4833-A605-D81533358E9B}.exeC:\Windows\{AF8BB187-43AA-4833-A605-D81533358E9B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5AEE822-D187-45c2-8AEF-D491BAA0A9FC}.exeC:\Windows\{C5AEE822-D187-45c2-8AEF-D491BAA0A9FC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7EDF7FB-5BF0-4f4d-865D-C296A5A0AAEE}.exeC:\Windows\{C7EDF7FB-5BF0-4f4d-865D-C296A5A0AAEE}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C19D0F70-0B56-4ff8-9378-C47C0ED5F82B}.exeC:\Windows\{C19D0F70-0B56-4ff8-9378-C47C0ED5F82B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BD16E3F-3388-48ae-9410-2DB54A4C73DD}.exeC:\Windows\{2BD16E3F-3388-48ae-9410-2DB54A4C73DD}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4FB6B281-BCB4-4c15-8B20-8C1190FDC9F6}.exeC:\Windows\{4FB6B281-BCB4-4c15-8B20-8C1190FDC9F6}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BD16~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C19D0~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7EDF~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5AEE~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF8BB~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16A31~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{138E5~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB630~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E69F4~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14DCB~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C586~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\59A067~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\{0C58675B-0545-475d-A744-9AF1A789E834}.exeFilesize
64KB
MD5d5a3602994bf70ca744b24e386fb5066
SHA10fe394f04eccdc12963bc2b420e4fac6750d5b56
SHA256d7e3e0551760de08b79b21150bd5a280ec39e74a2ff95c18351e67ca360e6afd
SHA5121f2a71036ca2fd95f551cf07de34647c2e8efd52f0d5758eef65d7ddfc16cef15ae375f3cb7beb44db927cf872251e45a84d34688f308d62ad80cbb4e7c67548
-
C:\Windows\{138E5281-B04E-4f2f-B37F-D39D0E211A95}.exeFilesize
64KB
MD59e9ea5aba4d67412eeec552b0d9d566b
SHA1eac374aa7d1ed77e59aeab52a53ea18ea5781701
SHA2560c0e90037c1c0dee59f3e5f525b2dfaebec4df4ec7af91f06301e4992076089c
SHA512dd2d27fbc4a7c5c2921f9cb14faf777ec0f23f8622ef17d01a9be4adb9eedaeff006a08fe07416c534da08cae152026e838ce5356e6bbfe307a7fe95e5ca4eee
-
C:\Windows\{14DCB60A-D6CA-4274-BF3A-66EEB167770A}.exeFilesize
64KB
MD5897feb442c8a3ce80855bc24cde37aba
SHA1177dfb143b8633baaf0972002c2b67eca3274518
SHA256ce72a4f6ee8b80b07ffe58b26d5607847146a4cf89258c42d84509d98d843cce
SHA512bbcb52e0e66cb85d761734afc19c1319c74ae0db4a096b805c947622a038b02e72df113c556792cf9c54c1d239efc6d15dc56696325e866f072b1964404c7567
-
C:\Windows\{16A31781-B95A-4791-B6B8-62AC3CF9F476}.exeFilesize
64KB
MD5ad532adfdd3a696a3a49e4458ce26f0d
SHA1141acd18dac2e240ae195cb12d45976585a9996c
SHA256e73a043e5a1a4913320b924e05df111c6b6f3313ec2d738c7de69ba48483b2c8
SHA5129a0fc5bf85cc3c0818aaf30b90dbbe6f5f66ac001f08f649900869c0e6d4876f84860a894e03d957f31bb6741ec539389afea73bcaf5e4dcebfe2e1896a05f87
-
C:\Windows\{2BD16E3F-3388-48ae-9410-2DB54A4C73DD}.exeFilesize
64KB
MD504816547f95d67d68d92bc1d2122417b
SHA19bea9cdb14c490ed32efe9a20ccee8b7dcb37c3a
SHA256d43d28e9f10c7d67700e5cf7f39ab4e920811f325e78ee4cf36a517daea95fa2
SHA5123af1f4d2f0fb2f305838c5b3c63f1a9dbea6fda2649e0c6e4868319fe681f5da44b35aca651246d78d7e96efb4a71e9368d452415fe07890cf43c4e2fc6cba4d
-
C:\Windows\{4FB6B281-BCB4-4c15-8B20-8C1190FDC9F6}.exeFilesize
64KB
MD572529e923bb48c4acab41e2e193cedbb
SHA1b05babd14c7dfc23bb7cfafa3c57923aeaef1b2f
SHA256b94dfa0fbf475b5c6d00a65ccd2c2a330cea7a7c6b6d87f6476a99864c3aaa1f
SHA512523b9976739101f78974f7c9c1f0df0312cf748f83f91e4528a620015783e1bf5a833a88d9b067f8f7c9daba1b6dc71f973befd195e2962d538a19003d12a00f
-
C:\Windows\{AF8BB187-43AA-4833-A605-D81533358E9B}.exeFilesize
64KB
MD59a33a1d78f5e280ebf979429ace74754
SHA18a8f9b3380a173bf6c3de19c6cf27508578db08c
SHA256d2730c00e9d4c78429531a0c48c36cd38da44304bbb17eb3cd3cf5ebeea43a22
SHA512501a05395896fababde5b375f3300360c80ae9efeb7195f843ffe0821a91a822b26c2a716d2ebeade52078eaef337a6bdbeea17d4af3f45dbab49ac38394b2fb
-
C:\Windows\{C19D0F70-0B56-4ff8-9378-C47C0ED5F82B}.exeFilesize
64KB
MD5c0251897d593c0677db731ee988ccb46
SHA18780dcb2910f02cb40e0b5550c10576a6ca336d4
SHA256b67f3139c8d93f00acc5b49c78d03f52638635d57714702ebaefe97be424dacf
SHA512188b3ea4db3cbbd57e93eaf6fb17866a08b702af70c0b1c52bdc3cae2cc65c23521e81d7508942abe31a61df51cbc8b4c2c9448496897071db4c6bb3101d8708
-
C:\Windows\{C5AEE822-D187-45c2-8AEF-D491BAA0A9FC}.exeFilesize
64KB
MD558b789d6cd5ed8987c302b5d96173dc7
SHA1d106500f3eec7617b02dd8f72d328ace46491cfc
SHA2568c9cb9314defbf94eb788bc4ef9dd2aabd477eb7cd0ac5b0c4344ce9038d9b34
SHA512a89f992b940079305a168c8d7c01940a3485f6aade3d49fe4904e4d4d187b8587486474e0e3db4584042832bc46640a6f21e858e100df9e347a428e2245d8876
-
C:\Windows\{C7EDF7FB-5BF0-4f4d-865D-C296A5A0AAEE}.exeFilesize
64KB
MD512602bdd44d04f3d387a3797fefe14b0
SHA1332fece16804c0c9b62a389eaaf36c425f80d03a
SHA256299bbf37bdef6b9e58726eea04d639826503baece677b449e140364ea095f78b
SHA51283b1ccde7bb7800fb426f116da4a27b0e1c976d3247e0710999bb44a682b69dfc7368d93a99dda75dbb8e7f36c971f05d8a70111927f76c4810cb0af41491fae
-
C:\Windows\{DB630DCB-5B2D-41db-ADD6-FA0D12921AA9}.exeFilesize
64KB
MD54a5ecec3e7dec06d63416ca53a5233e3
SHA1de54068bf91150b468d68b3067a67e7b6ccef7c3
SHA256956a155113b137dc3adf6dfca6f44510295f8bb4e43c710e17e9d66abdcc2fad
SHA51293a03cebc6cd4400621c3083ad79ccf867ed5d00c3903295fc2ab0e722036239797cca860892508bb397435e1e3e2a916729f443824a1ca35b7d69072d0f26b6
-
C:\Windows\{E69F472D-233B-4c5a-8F9E-5774DB6A7D72}.exeFilesize
64KB
MD550bb5782dc31e74459a329c5f2059e5f
SHA1e397751bf1936bfa49459a04d668d8ea93bc89eb
SHA256ca8814d714ab4d3d1cfc30bbe80dd89641c57aa2490f1f9ea121f9f47e18a2a2
SHA512f915eae46fa52dfa36cd5e8e4148520b92c929f7b9cd6081809c5d999494b7fc3a62a0507f65bc244958bdccce482bddc62cc5ba8756e5f259ed5325f91a224a
-
memory/388-23-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/388-28-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/700-58-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/700-63-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1576-53-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1576-56-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2456-15-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2456-12-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3052-22-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3052-18-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3264-41-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3264-35-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3744-42-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3744-46-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4640-51-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4872-34-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4872-30-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4896-0-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4896-5-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4968-10-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4968-6-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5260-71-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5516-64-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5516-70-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB