Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:39
Static task
static1
Behavioral task
behavioral1
Sample
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe
-
Size
6.5MB
-
MD5
3651dc512cac4bd58471f642f38a8070
-
SHA1
9b708a6dbdfbce2389056b2dd3e6d6ba1dd4a9d0
-
SHA256
7bdabaa62f22bbd8bfcabf9be081b57536a8f552170073a19d9d93a6d4add614
-
SHA512
826a6107d06c9b6f2c702460f3fdd20be85782e736f450f33f4cf7cd848795a18c7118fae2b417fbccd7db5278e1ae1c1503564469ed37d2101650fc932bafe6
-
SSDEEP
98304:bI9tiSH6a6gfFCZ8th/yp3qvZ4ypOKRxoBBTxBQk6dtQR:bAH6aff4+4p84yjRyBNxqQR
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
9fb6f0ed1595475ca4c55383074a7f94.exepid process 556 9fb6f0ed1595475ca4c55383074a7f94.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\Desktop.ini 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
Processes:
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\Desktop.ini 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe File opened for modification C:\Windows\assembly 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exedescription pid process target process PID 1204 wrote to memory of 556 1204 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe 9fb6f0ed1595475ca4c55383074a7f94.exe PID 1204 wrote to memory of 556 1204 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe 9fb6f0ed1595475ca4c55383074a7f94.exe PID 1204 wrote to memory of 556 1204 3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe 9fb6f0ed1595475ca4c55383074a7f94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3651dc512cac4bd58471f642f38a8070_NeikiAnalytics.exe"1⤵
- Drops file in Drivers directory
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9fb6f0ed1595475ca4c55383074a7f94.exe"C:\Users\Admin\AppData\Local\Temp\9fb6f0ed1595475ca4c55383074a7f94.exe" --012⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9fb6f0ed1595475ca4c55383074a7f94.exeFilesize
6.0MB
MD502e6bf47f5315e8da515ccae63f58a6e
SHA13469eec2964080610b188eceabc216a5f0244d2b
SHA256aad9c5c01c5c87d33da0695c53eb0bdae432d41452a2f54ddc1f23eb14928517
SHA512949bf7ff8eaa37a0c036af580f6bde633aec5336312f1c96d879aaf2398ee05f82a9d84ce002937b95382bedf2e7143e894b8d0feec478d074a1a3e1baf1d031
-
memory/1204-6-0x000000001CFD0000-0x000000001CFFE000-memory.dmpFilesize
184KB
-
memory/1204-2-0x000000001C7C0000-0x000000001CC8E000-memory.dmpFilesize
4.8MB
-
memory/1204-4-0x000000001CD30000-0x000000001CDCC000-memory.dmpFilesize
624KB
-
memory/1204-3-0x00007FFF9FC80000-0x00007FFFA0621000-memory.dmpFilesize
9.6MB
-
memory/1204-5-0x0000000001D90000-0x0000000001D98000-memory.dmpFilesize
32KB
-
memory/1204-0-0x00007FFF9FF35000-0x00007FFF9FF36000-memory.dmpFilesize
4KB
-
memory/1204-9-0x0000000001F70000-0x0000000001F7A000-memory.dmpFilesize
40KB
-
memory/1204-1-0x00007FFF9FC80000-0x00007FFFA0621000-memory.dmpFilesize
9.6MB
-
memory/1204-13-0x00007FFF9FC80000-0x00007FFFA0621000-memory.dmpFilesize
9.6MB
-
memory/1204-17-0x000000001DA90000-0x000000001DAB0000-memory.dmpFilesize
128KB
-
memory/1204-16-0x000000001CF00000-0x000000001CF10000-memory.dmpFilesize
64KB
-
memory/1204-18-0x000000001DAB0000-0x000000001DAC8000-memory.dmpFilesize
96KB
-
memory/1204-20-0x00007FFF9FC80000-0x00007FFFA0621000-memory.dmpFilesize
9.6MB