Overview

overview

7

Static

static

3

5d3539e22f...cs.exe

windows7-x64

7

5d3539e22f...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 23:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

  • Size

    384KB

  • MD5

    5d3539e22f24793a7296eee236095190

  • SHA1

    8db92d2a8e2f8490c2ebe714e74041eee6c60815

  • SHA256

    1bd732aa77751c7cba72448e4de7d4edd54c677241de2e93af42e0e31beca570

  • SHA512

    80f1eceafc64b0e9b8ae3a61f909aac4fae93e58cbd23ff22cf7ab98f3f054152bdfbf6650c9375fc1313a06ade910ef6ed43e528bb96f8c07b3cee9f46a4a88

  • SSDEEP

    12288:MY9EBDFq+5zU1nLDdFbHZ+XsSOk4+hu+eNWhVQ5zCD4TS:MY9MDFhYHQAWhVQ5zY4+

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 396
      2⤵
      • Program crash
      PID:2568
    • C:\Users\Admin\AppData\Local\Temp\5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 368
        3⤵
        • Program crash
        PID:3660
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3672 -ip 3672
    1⤵
      PID:3100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4740 -ip 4740
      1⤵
        PID:3440
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:3460

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
          Filesize

          384KB

          MD5

          488e1ab9c16e189225f48f4cd77097f2

          SHA1

          dc0326d9f7ef5100908f9f61dc153f534b736b2d

          SHA256

          1cb2926f562a2bbc46c765cbd0ffcbc2773b35d83b1a36399974f0fc5e00fdbb

          SHA512

          9da2a2795e6e6b2ffbd75637bb6bf43416880e0e8ea51c4e57f72ed7a85aff398fcc6bb6caeb0f8422e3357bdc53ca0c47594284980aea11b3e43ff1270a2859

          Download Submit
        • memory/3672-0-0x0000000000400000-0x0000000000446000-memory.dmp
          Filesize

          280KB

          Download
        • memory/3672-6-0x0000000000400000-0x0000000000446000-memory.dmp
          Filesize

          280KB

          Download
        • memory/4740-7-0x0000000000400000-0x0000000000446000-memory.dmp
          Filesize

          280KB

          Download
        • memory/4740-8-0x0000000000400000-0x000000000041A000-memory.dmp
          Filesize

          104KB

          Download
        • memory/4740-13-0x0000000001640000-0x0000000001686000-memory.dmp
          Filesize

          280KB

          Download
        • memory/4740-14-0x0000000000400000-0x0000000000446000-memory.dmp
          Filesize

          280KB

          Download