Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:49
Behavioral task
behavioral1
Sample
65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
65b2cef7b4d5b4e051d5e32fb7e9d910
-
SHA1
8bc44296c89d12c1d50d0d4a02a9b655b5833153
-
SHA256
cce2af940366a3186293d039dc4032936add30e7f520ed71d1785a6913fd6dcd
-
SHA512
043c04d62c8d79bb9a903736f07868f2f5ce2b7d681fbd5e8db8bec1da90f62f1fa04e683416af85c5712b03bfad1dea29f6105c22f191dea149443874ee500a
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlQvmp8RxAb5J6iHsl5THt:E5aIwC+Agr6StVEnmcKxYDvZThTHt
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/3616-16-0x0000000002D00000-0x0000000002D29000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exepid process 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exedescription pid process Token: SeTcbPrivilege 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe Token: SeTcbPrivilege 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exepid process 3616 65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exedescription pid process target process PID 3616 wrote to memory of 116 3616 65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe PID 3616 wrote to memory of 116 3616 65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe PID 3616 wrote to memory of 116 3616 65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 116 wrote to memory of 4508 116 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 2576 wrote to memory of 1760 2576 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe PID 3904 wrote to memory of 552 3904 76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\65b2cef7b4d5b4e051d5e32fb7e9d910_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\76b2cef8b4d6b4e061d6e32fb8e9d910_NeikiAnalytict.exeFilesize
1.3MB
MD565b2cef7b4d5b4e051d5e32fb7e9d910
SHA18bc44296c89d12c1d50d0d4a02a9b655b5833153
SHA256cce2af940366a3186293d039dc4032936add30e7f520ed71d1785a6913fd6dcd
SHA512043c04d62c8d79bb9a903736f07868f2f5ce2b7d681fbd5e8db8bec1da90f62f1fa04e683416af85c5712b03bfad1dea29f6105c22f191dea149443874ee500a
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
46KB
MD5c44d9f0ab5e9b66125830bba74f2979e
SHA10381f6b86d4f5fb076dd671ee837133820295d49
SHA256e5052c5ab87a2fb2010e90b078d79d33227d62d449a6345e383f22e893fbaa33
SHA51225e5248ce144c6557e54cbd8dec6dd3953815dde4ed67caef876eaa206f03234cdee8fd3a30362a7be0a0d147c857e42095aabdab40cb2c7af4c6eec36fea871
-
memory/116-28-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-29-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-41-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/116-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/116-26-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-27-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-35-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-52-0x0000000003060000-0x000000000311E000-memory.dmpFilesize
760KB
-
memory/116-30-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-36-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-37-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-32-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-53-0x0000000003120000-0x00000000033E9000-memory.dmpFilesize
2.8MB
-
memory/116-33-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-34-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/116-31-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/2576-69-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-68-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-71-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/2576-72-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2576-58-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-59-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-60-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-61-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-62-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-63-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-64-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-65-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-66-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/2576-67-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/3616-11-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-8-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/3616-14-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-2-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-16-0x0000000002D00000-0x0000000002D29000-memory.dmpFilesize
164KB
-
memory/3616-4-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/3616-13-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-12-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-3-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-10-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-9-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-5-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-7-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3616-6-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/4508-51-0x000001A31D6A0000-0x000001A31D6A1000-memory.dmpFilesize
4KB
-
memory/4508-47-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/4508-46-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB