305c1898da9c0553375b02f819b9614fd45ce43ace9ff863a4e0206347ac2153

Analysis

max time kernel
123s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
Size

5.4MB
MD5

684b8825efc50a5f035b13a69b1a3600
SHA1

b2b3e91c9af5979573d4e5fa9c65f2904b15770a
SHA256

305c1898da9c0553375b02f819b9614fd45ce43ace9ff863a4e0206347ac2153
SHA512

9c45af3cdb6e30a36e343a794e5c555965a678c4aa869fc584a7a9aa4d720e0b916ca2dca34300c9a7cde2cc074d47623b57a75119067fe9a6d12bbaaf82e102
SSDEEP

24576:7nTu8xZJ7TapW9GQc6S262jUfGhFdLswIKu+1gmfyzPUrytzprCZwaTEF5boKZkm:

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
Token: SeDebugPrivilege	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 4352	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	87
PID 2164 wrote to memory of 4352	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	87
PID 2164 wrote to memory of 4352	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	87
PID 2164 wrote to memory of 4352	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	87
PID 2164 wrote to memory of 4292	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	88
PID 2164 wrote to memory of 4292	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	88
PID 2164 wrote to memory of 4292	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	88
PID 2164 wrote to memory of 4292	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	88
PID 2164 wrote to memory of 1060	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	89
PID 2164 wrote to memory of 1060	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	89
PID 2164 wrote to memory of 1060	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	89
PID 2164 wrote to memory of 1060	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	89
PID 2164 wrote to memory of 3572	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	90
PID 2164 wrote to memory of 3572	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	90
PID 2164 wrote to memory of 3572	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	90
PID 2164 wrote to memory of 3572	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	90
PID 2164 wrote to memory of 3584	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	91
PID 2164 wrote to memory of 3584	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	91
PID 2164 wrote to memory of 3584	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	91
PID 2164 wrote to memory of 3584	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	91
PID 2164 wrote to memory of 3620	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	92
PID 2164 wrote to memory of 3620	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	92
PID 2164 wrote to memory of 3620	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	92
PID 2164 wrote to memory of 3620	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	92
PID 2164 wrote to memory of 4980	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	93
PID 2164 wrote to memory of 4980	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	93
PID 2164 wrote to memory of 4980	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	93
PID 2164 wrote to memory of 4980	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	93
PID 2164 wrote to memory of 2792	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	94
PID 2164 wrote to memory of 2792	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	94
PID 2164 wrote to memory of 2792	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	94
PID 2164 wrote to memory of 2792	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	94
PID 2164 wrote to memory of 2988	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	95
PID 2164 wrote to memory of 2988	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	95
PID 2164 wrote to memory of 2988	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	95
PID 2164 wrote to memory of 2988	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	95
PID 2164 wrote to memory of 540	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	96
PID 2164 wrote to memory of 540	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	96
PID 2164 wrote to memory of 540	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	96
PID 2164 wrote to memory of 540	2164	684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:3572
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:3584
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\684b8825efc50a5f035b13a69b1a3600_NeikiAnalytics.exe"
  2⤵
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

Filesize
4KB

Download
memory/2164-1-0x00000000006A0000-0x0000000000C0C000-memory.dmp

Filesize
5.4MB

Download
memory/2164-2-0x00000000067E0000-0x0000000006A98000-memory.dmp

Filesize
2.7MB

Download
memory/2164-3-0x0000000007050000-0x00000000075F4000-memory.dmp

Filesize
5.6MB

Download
memory/2164-4-0x0000000006B40000-0x0000000006BD2000-memory.dmp

Filesize
584KB

Download
memory/2164-5-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-8-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-6-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-24-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-46-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-44-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-56-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-42-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-60-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-68-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-64-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-62-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-59-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-54-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-52-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-50-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-48-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-66-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-40-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-38-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-36-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-34-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-32-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-30-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-28-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-22-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-20-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-18-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-16-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-14-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-12-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-10-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-26-0x00000000067E0000-0x0000000006A93000-memory.dmp

Filesize
2.7MB

Download
memory/2164-4885-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/2164-4886-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/2164-4887-0x0000000005830000-0x0000000005924000-memory.dmp

Filesize
976KB

Download
memory/2164-4888-0x0000000005650000-0x000000000569C000-memory.dmp

Filesize
304KB

Download
memory/2164-4889-0x00000000056D0000-0x0000000005724000-memory.dmp

Filesize
336KB

Download
memory/2164-4891-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download