Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 10:52
Static task
static1
Behavioral task
behavioral1
Sample
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
8490814de7e8c28c7bd10ff26417fbe0
-
SHA1
e16da889e40e3e99603890344b261ae1dc24a846
-
SHA256
e61197136373c59dcb8d919ee6504fc0200718bb27a2fd39333af0f6ef73cf09
-
SHA512
61b30dff356e8ced6e118223d4c5fe5f16202f4adf837a57732a357d3c24ba4bf3781937bd27c03400c780a7d09abfac5df998f6294cc5cfb4f94d4b3d45d1cd
-
SSDEEP
24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaizL/VwM4CPb2x5:Lh+ZkldoPK8YaiP2MFI
Malware Config
Extracted
formbook
4.1
es13
xn--p5tz1dc38d1tj.com
letszum.co
16475.autos
eat.company
ruletka-no-zero.store
mizj1yg0.shop
sxyaddhlmk.top
wlgj6789.cc
mammamiacookbook.com
sunart.tech
dutajp.co
odty58.app
newparentssupport.com
p2pprofitarbitrage.com
yeqzik.xyz
ncheikta.website
golfwick.com
premiumproducts.co.in
gemeinde-warringholz.com
bancamarch-web-avisos.com
bionischeswasser.com
aiquqiu10.com
66hkw.top
yepvs.online
gashtsafir.com
fox-investor.net
fingerbib.net
showyourself-fotokurse.com
63-ace.com
liveemffree.com
acessofacil.click
spencecollegeconsulting.com
l5r5f.us
ogmpconsulting.com
drlathian.net
et788.com
eternal.media
alloures.com
marcosmk.cloud
gameratez.com
aestheticgallery.net
renali.shop
pin-up-casino-scn8.top
wellwisenz.com
jl777-web.com
tlkatelier.com
nyxendesign.com
d89qrbh865r.shop
labyrinthsouthjordan.com
sdfntyowiop.com
foodsvisions.com
invitecmo.com
05557.vip
skinsoothesolutionscorner.com
trusdwallet.com
aegismasterseriesiceland.com
postadira.online
nolimit77gacor.site
warehouse-services-73488.bond
hzmzd.com
aviole.xyz
detensorprotocolio.network
1hjxz.top
bio-carwash.com
manoarquitetura.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4144-11-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4144-14-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4772-19-0x0000000000820000-0x000000000084F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exesvchost.exehelp.exedescription pid process target process PID 2256 set thread context of 4144 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe svchost.exe PID 4144 set thread context of 3436 4144 svchost.exe Explorer.EXE PID 4772 set thread context of 3436 4772 help.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4988 2256 WerFault.exe 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exehelp.exepid process 4144 svchost.exe 4144 svchost.exe 4144 svchost.exe 4144 svchost.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe 4772 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exesvchost.exehelp.exepid process 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe 4144 svchost.exe 4144 svchost.exe 4144 svchost.exe 4772 help.exe 4772 help.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 4144 svchost.exe Token: SeShutdownPrivilege 3436 Explorer.EXE Token: SeCreatePagefilePrivilege 3436 Explorer.EXE Token: SeShutdownPrivilege 3436 Explorer.EXE Token: SeCreatePagefilePrivilege 3436 Explorer.EXE Token: SeDebugPrivilege 4772 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exepid process 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exepid process 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3436 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exeExplorer.EXEhelp.exedescription pid process target process PID 2256 wrote to memory of 4144 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe svchost.exe PID 2256 wrote to memory of 4144 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe svchost.exe PID 2256 wrote to memory of 4144 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe svchost.exe PID 2256 wrote to memory of 4144 2256 8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe svchost.exe PID 3436 wrote to memory of 4772 3436 Explorer.EXE help.exe PID 3436 wrote to memory of 4772 3436 Explorer.EXE help.exe PID 3436 wrote to memory of 4772 3436 Explorer.EXE help.exe PID 4772 wrote to memory of 3176 4772 help.exe cmd.exe PID 4772 wrote to memory of 3176 4772 help.exe cmd.exe PID 4772 wrote to memory of 3176 4772 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\8490814de7e8c28c7bd10ff26417fbe0_NeikiAnalytics.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 7083⤵
- Program crash
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 22561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2256-10-0x0000000001220000-0x0000000001224000-memory.dmpFilesize
16KB
-
memory/3436-16-0x0000000008780000-0x00000000088BD000-memory.dmpFilesize
1.2MB
-
memory/3436-23-0x0000000008E20000-0x0000000008F79000-memory.dmpFilesize
1.3MB
-
memory/3436-24-0x0000000008E20000-0x0000000008F79000-memory.dmpFilesize
1.3MB
-
memory/3436-27-0x0000000008E20000-0x0000000008F79000-memory.dmpFilesize
1.3MB
-
memory/4144-11-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4144-12-0x0000000001600000-0x000000000194A000-memory.dmpFilesize
3.3MB
-
memory/4144-15-0x0000000001380000-0x0000000001394000-memory.dmpFilesize
80KB
-
memory/4144-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4772-18-0x0000000000160000-0x0000000000167000-memory.dmpFilesize
28KB
-
memory/4772-17-0x0000000000160000-0x0000000000167000-memory.dmpFilesize
28KB
-
memory/4772-19-0x0000000000820000-0x000000000084F000-memory.dmpFilesize
188KB