Analysis
-
max time kernel
20s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe
-
Size
501KB
-
MD5
6ca9db9b9460fcc18e55e931edceb1b0
-
SHA1
689679e228f5e1456109400e8068e5a0711ca9fd
-
SHA256
88fdd3ce3859dd7040e2c068636913dec2b7b630b4ff88121f1da6dd29d8ca1e
-
SHA512
855bf823b6885957b3644d981315a972739748e4a57f8e9a16acb8ab5f63fb12f692ff083267d30e820b8d064ca8913190b25e265158bd337358e148867f3a62
-
SSDEEP
6144:wlj7cMnU+c78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFs:wlbU+285bM3npxYfj63hgD1Zij
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
MSWDM.EXEMSWDM.EXE6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXEMSWDM.EXEpid process 2992 MSWDM.EXE 2032 MSWDM.EXE 1252 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE 2660 MSWDM.EXE -
Loads dropped DLL 1 IoCs
Processes:
MSWDM.EXEpid process 2032 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exeMSWDM.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
Processes:
6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exeMSWDM.EXEdescription ioc process File opened for modification C:\Windows\dev2877.tmp 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe File opened for modification C:\Windows\dev2877.tmp MSWDM.EXE File created C:\WINDOWS\MSWDM.EXE 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MSWDM.EXEpid process 2032 MSWDM.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXEpid process 1252 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE 1252 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE 1252 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exeMSWDM.EXEdescription pid process target process PID 1444 wrote to memory of 2992 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2992 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2992 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2992 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2032 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2032 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2032 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 1444 wrote to memory of 2032 1444 6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe MSWDM.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 1252 2032 MSWDM.EXE 6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE PID 2032 wrote to memory of 2660 2032 MSWDM.EXE MSWDM.EXE PID 2032 wrote to memory of 2660 2032 MSWDM.EXE MSWDM.EXE PID 2032 wrote to memory of 2660 2032 MSWDM.EXE MSWDM.EXE PID 2032 wrote to memory of 2660 2032 MSWDM.EXE MSWDM.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2992 -
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev2877.tmp!C:\Users\Admin\AppData\Local\Temp\6ca9db9b9460fcc18e55e931edceb1b0_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1252 -
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev2877.tmp!C:\Users\Admin\AppData\Local\Temp\6CA9DB9B9460FCC18E55E931EDCEB1B0_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
501KB
MD5517fb47bb2e8bfb841250ce01e5c52d5
SHA1917ddd90ef56450d329d1ba40db26cc6b8a50675
SHA256d208f4ad4f55fcce6322058f18650cd64a5cee58b54b5e5a6a9ca54262f9183b
SHA5121bfc901a0ce86cd64bfb4b25a773dd79da30ed9b971d93c5bb088efcb3a3e518e8c651e08397f00adf0d0cea61d8436957a229b89f7b9a2e43325cc884afadea
-
Filesize
47KB
MD52af966e7672f1e9c626245551247fb3a
SHA1e951cfe9ab27dad1f3df6e8189d0cf9b6dbbf66c
SHA2566b493904f292ff29033f7c6570485a7bef4d83eb9a71b2e64b9fc3308017a6c8
SHA512dfa2ae6cf2ff64bb9e3f884c02d348a9e615e94e6cbd05ce8bc98ec98d22dead2b6007e7da9e1d9e2317d53366c58611100146a68ff44526e93ea71d2561c98e
-
Filesize
453KB
MD596f7cb9f7481a279bd4bc0681a3b993e
SHA1deaedb5becc6c0bd263d7cf81e0909b912a1afd4
SHA256d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290
SHA512694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149