Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23-05-2024 02:57
General
-
Target
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
-
Size
632KB
-
MD5
7d4811b28f75404e7b666bb10651af50
-
SHA1
efe8751b4c3df9e6bbb336b0c435228831031bff
-
SHA256
e3e99e31c614ccbd645156b25469d87c139003814fc0975a1a530f8ece39822c
-
SHA512
a854b9d140946d5e3c545a155120a88ec405fc598275240c8feaf6b17f2ad8c4b942751f4da67678d817d1c4c0607835a839321af999c6cadf22d8858d7020ed
-
SSDEEP
12288:+58JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:eJ1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1602⤵
- Program crash
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD50f903c420fbf5ca0c43991b363167f45
SHA1070a596cfe5980b0e6e8b6ea0f76bdb535e952cf
SHA256036fb7b8cca540a3adab62b919597cbc4058f60f1ff475e31b621d7bb8a186f0
SHA512e041b0df87fc7785062549d485e3beaccf318262a119dc658855c9398e58f5f7dda2d1d053b618f7f5ef5ae55981da2df7e5e7a05928dfe80db0b2e8bf54e64f
-
Filesize
644KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
644KB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB