Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:12
Behavioral task
behavioral1
Sample
5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe
-
Size
39KB
-
MD5
5f582af99d1845d01c6e26714f68ca40
-
SHA1
133ef6586bb01f3525da4568548e70aa9a4cf738
-
SHA256
a5ea68343da28291c21c60191504b0e00f2bc62a53494110dc66a26fe374dcca
-
SHA512
9455b6d354cc5f4b210184d80c7356a2cece247a3a1302570770b3909a283d479ff47bfdee8e4eae04ff51a188373d471549151bca2028c119afa2921aee7bdc
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYan8e:qDdFJy3QMOtEvwDpjjWMl7Tdn8e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1908 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2184 5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2184-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000c00000001227b-11.dat upx behavioral1/memory/2184-13-0x0000000000600000-0x0000000000610000-memory.dmp upx behavioral1/memory/1908-18-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2184-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1908-28-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1908 2184 5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 1908 2184 5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 1908 2184 5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 1908 2184 5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f582af99d1845d01c6e26714f68ca40_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:1908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD547403b1744631fd5914f1e287de34083
SHA13531f73beff79e5575860e740b9cf6bd9fb028df
SHA256a21a4548b995c34db9a34005f11e95dd6e16c20707d100ca6012cb06699715ee
SHA512d64bb6992436e6df693772786f2bb01c24612655b8b3f47dd44024f7a8dfcca25ad2a0080198c012d7104d8226f476ed179ef1ba2fded7a6ce07afa7e4114d25