Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 23:39
General
-
Target
59bcdd8a6068ec4adc979b30ea4649d0_NeikiAnalytics.exe
-
Size
98KB
-
MD5
59bcdd8a6068ec4adc979b30ea4649d0
-
SHA1
510a290178e842e374b6f083b1995a3dd5be2bf2
-
SHA256
723b0e45525faab017480a266214a59f23b212b810333432c95866a546014359
-
SHA512
07a26e6c6bcc79338169733c0bc2aec5e8b97d08576d02ced76582bc22f779d82894008d5c8819002462b714f6c5af7e7a4b60e2322705ac8510599ae5f072a3
-
SSDEEP
768:5vw981UMhKQLrog4/wQ4pNrfrunMxVFA3b7glw6:lEG00ogl3zunMxVS3Hgl
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59bcdd8a6068ec4adc979b30ea4649d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\59bcdd8a6068ec4adc979b30ea4649d0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F190A454-B733-4080-A771-ABA7906FC956}.exeC:\Windows\{F190A454-B733-4080-A771-ABA7906FC956}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5826B995-2349-46a8-908E-A159A2266A46}.exeC:\Windows\{5826B995-2349-46a8-908E-A159A2266A46}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7F8C9AB-2505-4fc3-B3BE-474095AE0645}.exeC:\Windows\{A7F8C9AB-2505-4fc3-B3BE-474095AE0645}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05645A0A-EF93-4264-B3ED-7F24A04CCBCF}.exeC:\Windows\{05645A0A-EF93-4264-B3ED-7F24A04CCBCF}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{400FED36-47D4-426b-8F8D-F8A1AFA6C9AD}.exeC:\Windows\{400FED36-47D4-426b-8F8D-F8A1AFA6C9AD}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2D0E007-F555-4bcd-9EAC-AEE2FCED7889}.exeC:\Windows\{C2D0E007-F555-4bcd-9EAC-AEE2FCED7889}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4BE8FCE-0752-4926-9B1D-9B9CC9C24529}.exeC:\Windows\{D4BE8FCE-0752-4926-9B1D-9B9CC9C24529}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E6016B71-31FA-42a3-B717-E24D5FEF9FA4}.exeC:\Windows\{E6016B71-31FA-42a3-B717-E24D5FEF9FA4}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9F6CF2F9-9653-4d01-92FD-F57A605BCF99}.exeC:\Windows\{9F6CF2F9-9653-4d01-92FD-F57A605BCF99}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{69F76FD7-711E-4a74-81C0-5E34ED6F5487}.exeC:\Windows\{69F76FD7-711E-4a74-81C0-5E34ED6F5487}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5D7E3E83-C3C9-4519-B516-2779C544C72D}.exeC:\Windows\{5D7E3E83-C3C9-4519-B516-2779C544C72D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{501E3C4D-8CB6-4b58-B1B0-9A39328F524A}.exeC:\Windows\{501E3C4D-8CB6-4b58-B1B0-9A39328F524A}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D7E3~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69F76~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F6CF~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6016~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4BE8~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2D0E~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{400FE~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05645~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7F8C~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5826B~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F190A~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\59BCDD~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\{05645A0A-EF93-4264-B3ED-7F24A04CCBCF}.exeFilesize
98KB
MD5fab298d7adbb227e71196c5e1da7d897
SHA194da5bdd445ccf03d0fb5e8ce98ee930c08c6507
SHA256dd6a6e5edf56731498765ed37991dc2cada780c7c651e835b99b502e4072fec0
SHA51220b21e19b6c5029cba80209f3672d6d70d6dad1d52a10b0a7a96ca7073151d16edb27a9e7ee59293b6b271bc69c052bcc2ef23f6ab063ed195d86bac62d4f3cd
-
C:\Windows\{400FED36-47D4-426b-8F8D-F8A1AFA6C9AD}.exeFilesize
98KB
MD52aa93874d29d3ce35b66ca82f7117520
SHA18e0f94b66c0e0b2fb8fc4c6faad0bd5f04dc5a36
SHA2564c7e56bc2613dfdaa159e45a31107cd8515b10aad30f7cd23fae58d394f2fd72
SHA512ee4e811db90974f4054672cf8468e428b9a74430f813fdfdce1380e3fb4a13b8a946630d5c3bc32f3c14bf73be158848e9e73f4e1249bc3c836ed046e26a8c3f
-
C:\Windows\{501E3C4D-8CB6-4b58-B1B0-9A39328F524A}.exeFilesize
98KB
MD53eb5e7afebb17acf1cd8d19beb58ab19
SHA133408beeaab892f4ee7cb69f08e266d555a71acb
SHA25629486bddd100df7ee243cf43b4a4627ba05b23412b211d4848f5193c3ffbcac0
SHA512a5a98769fe382fa30739f0a3b8068c25abb07c6ceff563fdc6c1c8335d0a2e739f56355accc24642533c31afc11c1bad7e5fec0a5a06a02e0c75aa66e700e9d3
-
C:\Windows\{5826B995-2349-46a8-908E-A159A2266A46}.exeFilesize
98KB
MD55545157ce1446c5aaee447d56831da5e
SHA16c70af179e01ce8423b40e28dfb158a85139c332
SHA256801fdbf8ef0d4958219bc1e720f3ddd78985967d11fb3b2fc434ca1a42776eb4
SHA5124508d94eeb45a57c7e2ec3714e563d648c78ff9b6fb2ce11349f3194c7066f3f6875045257c018d1c41583a0e68fd54caaac831ca1ce673105415210365a9919
-
C:\Windows\{5D7E3E83-C3C9-4519-B516-2779C544C72D}.exeFilesize
98KB
MD5e103f508d0d9ee6ee02d17e1921da0d1
SHA1ef4d70a78885131c6c3a16d1dc8fda86102f944d
SHA256bf71a574497fe5d986dbf687063b998e924491295091c63cbe474bc04e036a91
SHA512fb46aacdc9a2428a251051c6c69a48ea77f235c682de3a4867bfee1a6b8b41e7832a34899c8f242442ef1facd4ca7c09ba4aed11f87b433758cb67a560f19b70
-
C:\Windows\{69F76FD7-711E-4a74-81C0-5E34ED6F5487}.exeFilesize
98KB
MD55db827af6b27ff385d0a74f880baae74
SHA122bc8b354fa82d798b0b52777003aa831defe355
SHA256573c4cb0859fefd8a404262268b563d5820eca5f88876601a138a8e10107e655
SHA512fd25a6ba39a1bdb8ff7018b451669686f2b634a0679f9f0b4d0afd20c69b93c87952719af08051616aedb4f0a8d5df2e8ba80805bc39c0cacff91ccd1c83f3db
-
C:\Windows\{9F6CF2F9-9653-4d01-92FD-F57A605BCF99}.exeFilesize
98KB
MD5751a0e83899411ea44226f835d961653
SHA13932c413a01d715435bdd2fa600ea5d14a8bc273
SHA256874d7b4e358a3b5cd5ab7ee24d99b9724e5296275fcf1b410874cb6c57c36738
SHA5121aa59f89d229a416936e21d3a46094af4442b224fb86612c12dd212ddb631b3e75091ffd6b4c311c1fb961cc72c4c6fa0573f7b4cbb39e49f2e2df2bbe6607fb
-
C:\Windows\{A7F8C9AB-2505-4fc3-B3BE-474095AE0645}.exeFilesize
98KB
MD5d3fbab479422b77c6d3c87126d4667f6
SHA1d42893ec2f909ca49679910263154a5ad618331b
SHA256f0dd5c90bb3e162d2272f13eb1e338a392a66235d7aed316275638f735be7c09
SHA5124be8bbf0241c36c87684650ae415e631aecff742ebaa642795129821412f0bee095a700498b74a73d4e52224d08bac5f27338ae188ebb71a2ddbdbbdcc81d0ae
-
C:\Windows\{C2D0E007-F555-4bcd-9EAC-AEE2FCED7889}.exeFilesize
98KB
MD5c356ca363f21dec9031bbfa600e61136
SHA1e786a132a5320b266f533bacff68fd850b9225a0
SHA256ac777e57b29f92051c59281d7b9f933ae2264eea5fe60ce9bc1feb06a1e3db0e
SHA512a6724cc4ac6f30edc03dbc546c3316bb58ec480238ecabce19613f1930545c42af52d00928b59d73b073b2ee0e4fc75e5b452edf6dd321c463416ca9f37841bf
-
C:\Windows\{D4BE8FCE-0752-4926-9B1D-9B9CC9C24529}.exeFilesize
98KB
MD5f520ef7b664e255da6a6209374f73cdd
SHA106be3daa4c1cec8cf0ebff43cfffb0a905eee2f9
SHA256a1b57c63c85d273f8d982b11b8e4a3668deaed5fffe47f57c492249b6cb65093
SHA512f467417edb5daa29df54c61301115dbe10773b7a4dbbf6180e6d71c96c92ead0a8e7cbf657a1389c4f7496534a3ca60ef06f488f7794f12eb980554c18713f3e
-
C:\Windows\{E6016B71-31FA-42a3-B717-E24D5FEF9FA4}.exeFilesize
98KB
MD543bce32b96b7bb0ec795309fde32a1a4
SHA185f6ff5d6fc520be4fd88d3ff732e35ea881da62
SHA256f9c4eb1bd9d532349baef270bcb35e8e83cfeec55bc07d53e7613fbb62d7b090
SHA51267c482fc4be9d6f9d832a4046125083a4af3d91d4f972442437263ac0dc707b463e6676bd8e269149af7442f0af9b3a2f646b1150eabc0173b7233e48c844fe4
-
C:\Windows\{F190A454-B733-4080-A771-ABA7906FC956}.exeFilesize
98KB
MD5b5ead97a1d9e70ae193eeb16b81a0e8b
SHA1e820207352abf8c5895dcc5a1731efdfee768cc4
SHA256a0df75b20d7d4f6cd6155570f7c8dfd4a9ef7b863771ddc8b29a7e8bf1d55865
SHA512450c3b6a3b14a3be230292c9804d46893d5d1771655412c4c9fdf44a6def515d34b5e1b038a82e213233d6800d7df66800047a5ddb4f22e9556b243069acbf82
-
memory/752-64-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/948-73-0x0000000000370000-0x0000000000381000-memory.dmpFilesize
68KB
-
memory/948-65-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/948-72-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1280-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1280-51-0x0000000000310000-0x0000000000321000-memory.dmpFilesize
68KB
-
memory/1544-75-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1544-82-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1736-8-0x00000000005D0000-0x00000000005E1000-memory.dmpFilesize
68KB
-
memory/1736-3-0x00000000005D0000-0x00000000005E1000-memory.dmpFilesize
68KB
-
memory/1736-9-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1736-0-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1988-113-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1988-108-0x0000000000250000-0x0000000000261000-memory.dmpFilesize
68KB
-
memory/2116-13-0x0000000000300000-0x0000000000311000-memory.dmpFilesize
68KB
-
memory/2116-17-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2400-37-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2400-47-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2400-42-0x0000000000370000-0x0000000000381000-memory.dmpFilesize
68KB
-
memory/2484-29-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2484-19-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2484-22-0x0000000000260000-0x0000000000271000-memory.dmpFilesize
68KB
-
memory/2520-28-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2520-38-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2648-94-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2648-98-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB
-
memory/2648-102-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2652-88-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/2652-84-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2652-92-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB