Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:39
Static task
static1
Behavioral task
behavioral1
Sample
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe
-
Size
6.5MB
-
MD5
3651dc512cac4bd58471f642f38a8070
-
SHA1
9b708a6dbdfbce2389056b2dd3e6d6ba1dd4a9d0
-
SHA256
7bdabaa62f22bbd8bfcabf9be081b57536a8f552170073a19d9d93a6d4add614
-
SHA512
826a6107d06c9b6f2c702460f3fdd20be85782e736f450f33f4cf7cd848795a18c7118fae2b417fbccd7db5278e1ae1c1503564469ed37d2101650fc932bafe6
-
SSDEEP
98304:bI9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQR:bAH6aff4+4p84yjRyBNxqQR
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
d003e9c94f7049fdaa7f94d6df34afa0.exepid process 2552 d003e9c94f7049fdaa7f94d6df34afa0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exedescription pid process target process PID 820 wrote to memory of 2552 820 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe d003e9c94f7049fdaa7f94d6df34afa0.exe PID 820 wrote to memory of 2552 820 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe d003e9c94f7049fdaa7f94d6df34afa0.exe PID 820 wrote to memory of 2552 820 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe d003e9c94f7049fdaa7f94d6df34afa0.exe PID 820 wrote to memory of 2552 820 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe d003e9c94f7049fdaa7f94d6df34afa0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d003e9c94f7049fdaa7f94d6df34afa0.exe"C:\Users\Admin\AppData\Local\Temp\d003e9c94f7049fdaa7f94d6df34afa0.exe" --012⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d003e9c94f7049fdaa7f94d6df34afa0.exeFilesize
6.0MB
MD502e6bf47f5315e8da515ccae63f58a6e
SHA13469eec2964080610b188eceabc216a5f0244d2b
SHA256aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517
SHA512949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031
-
memory/820-0-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmpFilesize
4KB
-
memory/820-1-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/820-2-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/820-3-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/820-4-0x000000001B340000-0x000000001B36E000-memory.dmpFilesize
184KB
-
memory/820-5-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/820-12-0x00000000002F0000-0x0000000000300000-memory.dmpFilesize
64KB
-
memory/820-13-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB