305c1898da9c0553375b02f819b9614fd45ce43ace9ff863a4e0206347ac2153

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
Size

5.4MB
MD5

684b8825efc50a5f035b13a69b1a3600
SHA1

b2b3e91c9af5979573d4e5fa9c65f2904b15770a
SHA256

305c1898da9c0553375b02f819b9614fd45ce43ace9ff863a4e0206347ac2153
SHA512

9c45af3cdb6e30a36e343a794e5c555965a678c4aa869fc584a7a9aa4d720e0b916ca2dca34300c9a7cde2cc074d47623b57a75119067fe9a6d12bbaaf82e102
SSDEEP

24576:7nTu8xZJ7TapW9GQc6S262jUfGhFdLswIKu+1gmfyzPUrytzprCZwaTEF5boKZkm:

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
Token: SeDebugPrivilege	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2524	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	28
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2616	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	29
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2488	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	30
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2928	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	31
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2700	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	32
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 2536	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	33
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 1224	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	34
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35
PID 2864 wrote to memory of 2256	2864	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	35

C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2256
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:756
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2864-1-0x0000000001250000-0x00000000017BC000-memory.dmp

Filesize
5.4MB

Download
memory/2864-2-0x0000000005F70000-0x0000000006228000-memory.dmp

Filesize
2.7MB

Download
memory/2864-3-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-10-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-8-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-6-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-4-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-20-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-12-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-22-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-24-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-14-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-26-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-28-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-18-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-16-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-30-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-32-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-34-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-36-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-38-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-41-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-58-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-56-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-54-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-52-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-50-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-48-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-46-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-45-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-42-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-62-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-66-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-64-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-60-0x0000000005F70000-0x0000000006223000-memory.dmp

Filesize
2.7MB

Download
memory/2864-4884-0x0000000000B40000-0x0000000000B8C000-memory.dmp

Filesize
304KB

Download
memory/2864-4883-0x0000000007CE0000-0x0000000007DD4000-memory.dmp

Filesize
976KB

Download
memory/2864-4886-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-4885-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-4887-0x0000000000B90000-0x0000000000BE4000-memory.dmp

Filesize
336KB

Download
memory/2864-4906-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download