Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 22:58
Behavioral task
behavioral1
Sample
79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
79def490bc257c50acbd8d39ba3c3dd0
-
SHA1
0eecd42d71af1b81d8492586aee7d45cf668adef
-
SHA256
4a78768ec0773d008f88d9ee145c807812555977242cf5b0cf79d46427da29f6
-
SHA512
52083db0c2ddd9b3a4859acf2f45602fa2ed98003e379348cd07ecba89ddd26735a5febbc0de41f375c80d7918da89e21ec2c5b94e6f047afdb3207091f7558e
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/Zc9ggeS6X0zh/:E5aIwC+Agr6S/FFC+Hh/
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023406-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/4988-15-0x0000000002AD0000-0x0000000002AF9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe Token: SeTcbPrivilege 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4988 79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 456 4988 79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe 83 PID 4988 wrote to memory of 456 4988 79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe 83 PID 4988 wrote to memory of 456 4988 79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe 83 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 456 wrote to memory of 1404 456 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 84 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 1520 wrote to memory of 2068 1520 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 102 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 PID 3624 wrote to memory of 2648 3624 89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe 111 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\79def490bc257c50acbd8d39ba3c3dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Roaming\WinSocket\89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1404
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2068
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\89def490bc268c60acbd9d39ba3c3dd0_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD579def490bc257c50acbd8d39ba3c3dd0
SHA10eecd42d71af1b81d8492586aee7d45cf668adef
SHA2564a78768ec0773d008f88d9ee145c807812555977242cf5b0cf79d46427da29f6
SHA51252083db0c2ddd9b3a4859acf2f45602fa2ed98003e379348cd07ecba89ddd26735a5febbc0de41f375c80d7918da89e21ec2c5b94e6f047afdb3207091f7558e
-
Filesize
67KB
MD554dc536a30527df907daebfc074f0ad0
SHA18dc8bfd3537798dcf1f55e75cd87de849d24ac7e
SHA2569257f77982197cd5011caeea15dd55e9332c3bb5647e9373fb9e80efdf84350d
SHA512910ee6d68896c3ff8576663f873349a96a4e6c25231d3affddc50ee4e05487724c2b0cd33e2960fb6177aae16f848cc241fb159257f4dc24e431d628bf76dd4b