Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:32
Static task
static1
Behavioral task
behavioral1
Sample
78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe
-
Size
64KB
-
MD5
78a20cce6a44f3d8cb9dfe0adb568290
-
SHA1
9bffc6b37dc8161b630e5239aebaa64e856d3320
-
SHA256
8be03688b6eff48b49576b96010bb6e421d4f3360587d4fafd98abfcec6f7d15
-
SHA512
4323e87db51f8775d378b0590dad0c92316109b71f9f109723e71e661900131880cc0780f4d0e16087b75347cddd5d2522850522d64ceeff66613fba49405cd6
-
SSDEEP
768:T+Cru/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpR0OTW/ReOOW:TaRTzy48untU8fOMEI3jyYfPBYOW
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.execmd.exeiexpress.exedescription pid process target process PID 2140 wrote to memory of 784 2140 78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe cmd.exe PID 2140 wrote to memory of 784 2140 78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe cmd.exe PID 2140 wrote to memory of 784 2140 78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe cmd.exe PID 2140 wrote to memory of 784 2140 78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe cmd.exe PID 784 wrote to memory of 2392 784 cmd.exe iexpress.exe PID 784 wrote to memory of 2392 784 cmd.exe iexpress.exe PID 784 wrote to memory of 2392 784 cmd.exe iexpress.exe PID 784 wrote to memory of 2392 784 cmd.exe iexpress.exe PID 2392 wrote to memory of 1164 2392 iexpress.exe makecab.exe PID 2392 wrote to memory of 1164 2392 iexpress.exe makecab.exe PID 2392 wrote to memory of 1164 2392 iexpress.exe makecab.exe PID 2392 wrote to memory of 1164 2392 iexpress.exe makecab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CB3B.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\78a20cce6a44f3d8cb9dfe0adb568290_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CB3B.tmp\1.batFilesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
C:\Users\Admin\AppData\Local\Temp\popup.sedFilesize
64KB
MD56bed73a4aaa55c36f810be95b559ce77
SHA1244e92a1db7fd27f8b65399d10c84880dac0a295
SHA256bd601a3674718efc7376176c5b357de9b99f17b44f1bfcd4926d6bcbb10120a7
SHA5122e14afe18347982de89096298f06c0b689c4f7f70602e63d62ad4ca22c729e90fade156a9062f8fb66071fe0e2778b648bbdf00f2f8832f5fa697df54a69a7fc
-
C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDFFilesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083