Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 03:24
Static task
static1
Behavioral task
behavioral1
Sample
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe
-
Size
805KB
-
MD5
81e28232e0556eb0385f23d2900b3c00
-
SHA1
0533aa69b50cbfeecb4c76ba81936d43884f8d06
-
SHA256
11eee46ccd42bb8b8e7c93b401450975770f7b7ab8811d4ec3dbe3ac90a4f2c1
-
SHA512
b51eff6bf2d94816dd45003d8bff50e9eacbc42ee0c537e01fdca081a72bcccf3c9856061f1ad1f530f5fe57a3ae929f279127d2ba042f46017513a45c98f3eb
-
SSDEEP
12288:HlGp0BpeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:HXHet/HU9zPjeidP1Yi/dGyA
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
alg.exepid process 480 3004 alg.exe -
Drops file in System32 directory 2 IoCs
Processes:
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exealg.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9c05ffff3d2ec148.bin alg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1672 2184 WerFault.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exedescription pid process Token: SeTakeOwnershipPrivilege 2184 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exedescription pid process target process PID 2184 wrote to memory of 1672 2184 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe WerFault.exe PID 2184 wrote to memory of 1672 2184 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe WerFault.exe PID 2184 wrote to memory of 1672 2184 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe WerFault.exe PID 2184 wrote to memory of 1672 2184 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 2162⤵
- Program crash
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\System32\alg.exeFilesize
644KB
MD5fbb77ee97f353b049cfef3613efdfa53
SHA171ed96cb0b6dcd2a367a5f3e620436e67a5a0b54
SHA256880a67d0a144d15f499ed771a0d70faaedb57cb3662313bb1bc1eff895a37dac
SHA512730b15dbe83371aecc57471f085b277d9f2d50951789e65fc3d759ad0472d4b60590b894072627539befda7543ff7df670b98c3bcd5cb584e49f93d53b0bc7d0
-
memory/2184-0-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/2184-1-0x00000000004D0000-0x0000000000537000-memory.dmpFilesize
412KB
-
memory/2184-6-0x00000000004D0000-0x0000000000537000-memory.dmpFilesize
412KB
-
memory/2184-22-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/3004-12-0x0000000100000000-0x00000001000A4000-memory.dmpFilesize
656KB
-
memory/3004-19-0x0000000000840000-0x00000000008A0000-memory.dmpFilesize
384KB
-
memory/3004-13-0x0000000000840000-0x00000000008A0000-memory.dmpFilesize
384KB
-
memory/3004-23-0x0000000100000000-0x00000001000A4000-memory.dmpFilesize
656KB