Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
-
Size
632KB
-
MD5
7d4811b28f75404e7b666bb10651af50
-
SHA1
efe8751b4c3df9e6bbb336b0c435228831031bff
-
SHA256
e3e99e31c614ccbd645156b25469d87c139003814fc0975a1a530f8ece39822c
-
SHA512
a854b9d140946d5e3c545a155120a88ec405fc598275240c8feaf6b17f2ad8c4b942751f4da67678d817d1c4c0607835a839321af999c6cadf22d8858d7020ed
-
SSDEEP
12288:+58JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:eJ1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
alg.exepid process 476 1812 alg.exe -
Drops file in System32 directory 2 IoCs
Processes:
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exealg.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4cf056f5ad1aea39.bin alg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2772 884 WerFault.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exedescription pid process Token: SeTakeOwnershipPrivilege 884 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exedescription pid process target process PID 884 wrote to memory of 2772 884 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe WerFault.exe PID 884 wrote to memory of 2772 884 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe WerFault.exe PID 884 wrote to memory of 2772 884 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe WerFault.exe PID 884 wrote to memory of 2772 884 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1602⤵
- Program crash
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\System32\alg.exeFilesize
644KB
MD50f903c420fbf5ca0c43991b363167f45
SHA1070a596cfe5980b0e6e8b6ea0f76bdb535e952cf
SHA256036fb7b8cca540a3adab62b919597cbc4058f60f1ff475e31b621d7bb8a186f0
SHA512e041b0df87fc7785062549d485e3beaccf318262a119dc658855c9398e58f5f7dda2d1d053b618f7f5ef5ae55981da2df7e5e7a05928dfe80db0b2e8bf54e64f
-
memory/884-0-0x0000000000400000-0x00000000004A1000-memory.dmpFilesize
644KB
-
memory/884-1-0x0000000000220000-0x0000000000287000-memory.dmpFilesize
412KB
-
memory/884-8-0x0000000000220000-0x0000000000287000-memory.dmpFilesize
412KB
-
memory/884-24-0x0000000000400000-0x00000000004A1000-memory.dmpFilesize
644KB
-
memory/1812-13-0x0000000100000000-0x00000001000A4000-memory.dmpFilesize
656KB
-
memory/1812-14-0x00000000008C0000-0x0000000000920000-memory.dmpFilesize
384KB
-
memory/1812-22-0x00000000008C0000-0x0000000000920000-memory.dmpFilesize
384KB
-
memory/1812-25-0x0000000100000000-0x00000001000A4000-memory.dmpFilesize
656KB