Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe
-
Size
104KB
-
MD5
a1f936a18349299f116d96394b8905b0
-
SHA1
76b132e0051677af4fb446098da329aff10d695e
-
SHA256
36147d490471a933d553d80368a7050e3350ce4cf8076dcdef9b89259140577d
-
SHA512
6c6e87b84c95f0e4cd835943292200cee82c7a54e9a6360fb78ef277f6d8d5cd53f0ac48238c9526839a3ad4b8932f4c8416448c3aa82ebc984ba921360eba0f
-
SSDEEP
3072:HAoAliulHnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nbnl1RRhCy:gSAw65
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
microsofthelp.exepid process 1736 microsofthelp.exe -
Executes dropped EXE 1 IoCs
Processes:
microsofthelp.exepid process 1736 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exemicrosofthelp.exedescription ioc process File created C:\Windows\microsofthelp.exe a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exedescription pid process target process PID 2084 wrote to memory of 1736 2084 a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe microsofthelp.exe PID 2084 wrote to memory of 1736 2084 a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe microsofthelp.exe PID 2084 wrote to memory of 1736 2084 a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe microsofthelp.exe PID 2084 wrote to memory of 1736 2084 a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe microsofthelp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1f936a18349299f116d96394b8905b0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\microsofthelp.exeFilesize
104KB
MD5a3d38f7adb76912abf5249428b470d2a
SHA14679b428a4b501c3333ecf4dc6dbb5538d6ad4bc
SHA256e0e90f77bc657c8565e910dd1c85df924dc459cb2b6c09801bd76f81d6c5c6ca
SHA51286e71a40a90af21edf068c80885e4b1dbb7a37e283f7b77735afb2efe6cd5256bce603ea20b99f15efb506914052f007890c5faefa95bd80133fa27bde858a2f
-
memory/1736-8-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/2084-0-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/2084-6-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB