Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe
-
Size
79KB
-
MD5
266fcb736df848a6d4fe8aba9c2fc690
-
SHA1
d6715f489ca84a1d3bbb05b39a548220b4f12525
-
SHA256
bead02c3526ddebff859d1a945d7d147a8d38514f1d11cd95c8e3e58cdabfdef
-
SHA512
013e00217959c87b35bf4a19870a923b1cdc3c31bfb21f1e2507e2b10683696b70c9165a8e63376b81c4e194192f3b4acab1985216ff6079118adb8b58b7faa2
-
SSDEEP
1536:zvDkSFQbBgkHBsSpOQA8AkqUhMb2nuy5wgIP0CSJ+5ymCmB8GMGlZ5G:zvDk8IBTSlGdqU7uy5w9WMymFN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3844 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 212 wrote to memory of 860 212 266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe 84 PID 212 wrote to memory of 860 212 266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe 84 PID 212 wrote to memory of 860 212 266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe 84 PID 860 wrote to memory of 3844 860 cmd.exe 85 PID 860 wrote to memory of 3844 860 cmd.exe 85 PID 860 wrote to memory of 3844 860 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\cmd.exePID:860
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:3844
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5c3e4c2257f3e9543abb08d870a98a5a9
SHA1c1250c3817317e554cae8b5a13a7187897525da2
SHA25697bf0d6340e21fb58df0781c84985baffac7c7653e889a34a115ad91a211da88
SHA5128b2539c7611ceb4aa98b87ca8c2115fb6a5ea6ef44b35f1b752191fe2495c03584811fddab979a22a12a1b533af6428eed3ce6b902c95c66f03f073bf4039b2b