Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
23-05-2024 03:24
General
-
Target
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe
-
Size
805KB
-
MD5
81e28232e0556eb0385f23d2900b3c00
-
SHA1
0533aa69b50cbfeecb4c76ba81936d43884f8d06
-
SHA256
11eee46ccd42bb8b8e7c93b401450975770f7b7ab8811d4ec3dbe3ac90a4f2c1
-
SHA512
b51eff6bf2d94816dd45003d8bff50e9eacbc42ee0c537e01fdca081a72bcccf3c9856061f1ad1f530f5fe57a3ae929f279127d2ba042f46017513a45c98f3eb
-
SSDEEP
12288:HlGp0BpeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:HXHet/HU9zPjeidP1Yi/dGyA
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 2162⤵
- Program crash
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD5fbb77ee97f353b049cfef3613efdfa53
SHA171ed96cb0b6dcd2a367a5f3e620436e67a5a0b54
SHA256880a67d0a144d15f499ed771a0d70faaedb57cb3662313bb1bc1eff895a37dac
SHA512730b15dbe83371aecc57471f085b277d9f2d50951789e65fc3d759ad0472d4b60590b894072627539befda7543ff7df670b98c3bcd5cb584e49f93d53b0bc7d0
-
Filesize
824KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
824KB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB