Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 21:18
Static task
static1
Behavioral task
behavioral1
Sample
122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe
-
Size
237KB
-
MD5
122a8c9bd9068f75103c66b8f9fc7dc0
-
SHA1
0c45824f57253a9b2531fded3f8901fd552f804e
-
SHA256
088d60b6f184cc48293a7ba2a7ec5cc8b5cb53508ae92a14611bf905510f9270
-
SHA512
0a2de3d2e7c4ecdc79f1f71b1bf847248d6f197fd11c92ca58e9266cf6fa9e4626ebfabf1d056202d3d17099d23b8404b1a5f97ef86ea0036f8f88b485a48e9c
-
SSDEEP
6144:pA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:pATuTAnKGwUAWVycQqgj
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\DE16C900 = "C:\\Users\\Admin\\AppData\\Roaming\\DE16C900\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
winver.exepid process 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe 1152 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1152 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exewinver.exedescription pid process target process PID 1708 wrote to memory of 1152 1708 122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe winver.exe PID 1708 wrote to memory of 1152 1708 122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe winver.exe PID 1708 wrote to memory of 1152 1708 122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe winver.exe PID 1708 wrote to memory of 1152 1708 122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe winver.exe PID 1708 wrote to memory of 1152 1708 122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe winver.exe PID 1152 wrote to memory of 1216 1152 winver.exe Explorer.EXE PID 1152 wrote to memory of 1104 1152 winver.exe taskhost.exe PID 1152 wrote to memory of 1168 1152 winver.exe Dwm.exe PID 1152 wrote to memory of 1216 1152 winver.exe Explorer.EXE PID 1152 wrote to memory of 1708 1152 winver.exe 122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\122a8c9bd9068f75103c66b8f9fc7dc0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-25-0x0000000000450000-0x0000000000456000-memory.dmpFilesize
24KB
-
memory/1104-11-0x0000000000450000-0x0000000000456000-memory.dmpFilesize
24KB
-
memory/1152-27-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/1152-4-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB
-
memory/1152-22-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/1168-14-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1168-23-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1216-1-0x0000000002D60000-0x0000000002D66000-memory.dmpFilesize
24KB
-
memory/1216-17-0x0000000002DB0000-0x0000000002DB6000-memory.dmpFilesize
24KB
-
memory/1216-24-0x0000000002DB0000-0x0000000002DB6000-memory.dmpFilesize
24KB
-
memory/1216-3-0x0000000002D60000-0x0000000002D66000-memory.dmpFilesize
24KB
-
memory/1216-6-0x0000000002D60000-0x0000000002D66000-memory.dmpFilesize
24KB
-
memory/1708-8-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB