Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 10:45
Behavioral task
behavioral1
Sample
461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
461166691585b3f1dc6a8a90ad14df60
-
SHA1
cfa3fb80260f81ef6a4b3e53edc6de8e13be59bc
-
SHA256
453242da5b43a5e3aa2754dce79eccafad38c6d045dd24a5df52d2f19e508d7b
-
SHA512
565fde9ea90bbcc0e58345b8608c2a60d1548c48b49d5ea52d788d65c4a73b98854d8b66f7a1e1ecd8246117cb22e1de59b77d699fad9012e22b7540e537fa07
-
SSDEEP
24576:vCaehx36QZvHdPnLxRYUVlqcH9TDR3GmoKeBSwyS3GS8jgNGeu8oS9YJzYF7kMVI:ar36QVBLLnPj35GLMC2jgNGZ8+JzCA
Malware Config
Signatures
-
XMRig Miner payload 14 IoCs
resource yara_rule behavioral2/memory/4696-3-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-4-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-7-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-8-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-11-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-12-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-13-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-14-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-15-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-16-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-17-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-18-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-19-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig behavioral2/memory/4696-20-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/4696-0-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-3-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-4-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-7-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-8-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-11-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-12-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-13-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-14-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-15-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-16-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-17-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-18-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-19-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx behavioral2/memory/4696-20-0x00007FF7A63E0000-0x00007FF7A6B25000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe Token: SeLockMemoryPrivilege 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4696 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4696