Analysis
-
max time kernel
136s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 06:05
Behavioral task
behavioral1
Sample
bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
bc8504fbe10303b79ca437bd095fd900
-
SHA1
bff737fd1845ef4c2060a43cdf2e4d71bd1e8c3b
-
SHA256
f591ebd22feddda2db8b82abbb3d4e79b6486db564fe0fc15428d8eee2bbbd16
-
SHA512
0133af1d43d8102a022c28b99d381d111d8c33275973f81fd3c96803f6892ec830de9d96bdf403ee8a024fac43f4c87014351215b20df11f0815c0844cc9f522
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlQvmp8RxAb5J6iHsl5Tyx:E5aIwC+Agr6StVEnmcKxYDvZThTyx
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral2/memory/2896-15-0x00000000021F0000-0x0000000002219000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exepid process 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exedescription pid process Token: SeTcbPrivilege 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe Token: SeTcbPrivilege 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exepid process 2896 bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exebc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exedescription pid process target process PID 2896 wrote to memory of 212 2896 bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe PID 2896 wrote to memory of 212 2896 bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe PID 2896 wrote to memory of 212 2896 bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 212 wrote to memory of 1580 212 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 4560 wrote to memory of 2724 4560 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe PID 3208 wrote to memory of 1112 3208 bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bc8504fbe10303b79ca437bd095fd900_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WinSocket\bc9604fbe10303b89ca438bd096fd900_NeikiAnalytict.exeFilesize
1.3MB
MD5bc8504fbe10303b79ca437bd095fd900
SHA1bff737fd1845ef4c2060a43cdf2e4d71bd1e8c3b
SHA256f591ebd22feddda2db8b82abbb3d4e79b6486db564fe0fc15428d8eee2bbbd16
SHA5120133af1d43d8102a022c28b99d381d111d8c33275973f81fd3c96803f6892ec830de9d96bdf403ee8a024fac43f4c87014351215b20df11f0815c0844cc9f522
-
C:\Users\Admin\AppData\Roaming\WinSocket\settings.iniFilesize
11KB
MD51019b49d0b263cb423996675e30b6fc2
SHA1b5988e17a8593648bcf31010108782705a98945b
SHA2563c8439cd2774533e94fa6430834a15c3bbfdfda81d3b98f91dfd800e64cf7b2a
SHA512744f907dd0862dc4b386e1904f7c6aa47a52b8778310b488fab8b195a398f1db0919a065e427d999c37e7cf0c9c5126661d54f2b03c83bde3b7cf3af37841524
-
memory/212-33-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-29-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-35-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-36-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-40-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/212-26-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-27-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-28-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-42-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/212-52-0x0000000003060000-0x000000000311E000-memory.dmpFilesize
760KB
-
memory/212-30-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-31-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-32-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-34-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/212-53-0x0000000003120000-0x00000000033E9000-memory.dmpFilesize
2.8MB
-
memory/212-37-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/1580-46-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/1580-47-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/1580-51-0x000002BC0ACC0000-0x000002BC0ACC1000-memory.dmpFilesize
4KB
-
memory/2896-3-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-5-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/2896-2-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-14-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-4-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-15-0x00000000021F0000-0x0000000002219000-memory.dmpFilesize
164KB
-
memory/2896-13-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-6-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-7-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-8-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-9-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-10-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-11-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-12-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/2896-19-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4560-69-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-67-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-66-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-65-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-64-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-63-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-62-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-61-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-60-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-59-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-58-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4560-73-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/4560-72-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/4560-68-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB