Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 22:45
Static task
static1
Behavioral task
behavioral1
Sample
2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe
-
Size
270KB
-
MD5
2dd4c7105c13ef07fba4aa155e081840
-
SHA1
e8d328c9e163490b0d22f781bc6fbaa481b97ad7
-
SHA256
441e5e59d01f656d8cb69cf40ee60938e91f422c03b2556de953f811a839df92
-
SHA512
53998bc7f2b227a63a559db41e2587d3e318667e1c9abeed937a10e0661bdfba1d34e70ca543ef45aa8d7311f56047cf483f61b0ed7221bca5245b578090f833
-
SSDEEP
3072:Es2Fhz52XsaRmJ+w+JkAu/heWp0gaWOsGI7b8nrvD3UD7hLSe8140QYtJqUAsZ/3:WccymjqBW65YGIsnrAX14tOMF
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2968 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2616 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2616 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.execmd.exedescription pid process target process PID 1784 wrote to memory of 2968 1784 2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 2968 1784 2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 2968 1784 2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe cmd.exe PID 1784 wrote to memory of 2968 1784 2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe cmd.exe PID 2968 wrote to memory of 2616 2968 cmd.exe taskkill.exe PID 2968 wrote to memory of 2616 2968 cmd.exe taskkill.exe PID 2968 wrote to memory of 2616 2968 cmd.exe taskkill.exe PID 2968 wrote to memory of 2616 2968 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2dd4c7105c13ef07fba4aa155e081840_NeikiAnalytics.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1784-1-0x0000000002DD0000-0x0000000002ED0000-memory.dmpFilesize
1024KB
-
memory/1784-2-0x0000000000220000-0x000000000025C000-memory.dmpFilesize
240KB
-
memory/1784-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1784-9-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1784-8-0x0000000000220000-0x000000000025C000-memory.dmpFilesize
240KB
-
memory/1784-7-0x0000000002DD0000-0x0000000002ED0000-memory.dmpFilesize
1024KB
-
memory/1784-6-0x0000000000400000-0x0000000002CA2000-memory.dmpFilesize
40.6MB