Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 12:50
Behavioral task
behavioral1
Sample
8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
8e5ff1a22955654aea692376feaa5f20
-
SHA1
6454581d591f6d3a144d1d1e95ce21e14eb5e502
-
SHA256
02102acc100b9f717d2aa3fb8a9a5357680bb3d42df731474ce10234354fefdf
-
SHA512
e9698fce960dd153077161089c57cc9d55c2d41b8b813a55ebabba9bf8fae99b04ad0890dc4c60482caa8c2571e3a7536697053db3da22e567e2b1817add296f
-
SSDEEP
24576:zQ5aILMCfmAUjzX677WOMcT/X2dI7T2FAoUcUOp6doF5ES/oUKs:E5aIwC+Agr6tdlmU1/eoM
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023442-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/3444-15-0x0000000002A80000-0x0000000002AA9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe Token: SeTcbPrivilege 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3444 8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 2732 3444 8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe 85 PID 3444 wrote to memory of 2732 3444 8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe 85 PID 3444 wrote to memory of 2732 3444 8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe 85 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 2732 wrote to memory of 2848 2732 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 86 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 3044 wrote to memory of 2924 3044 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 103 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 PID 4748 wrote to memory of 4832 4748 9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe 112 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8e5ff1a22955654aea692376feaa5f20_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Roaming\WinSocket\9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2848
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2924
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\9e6ff1a22966764aea792387feaa6f20_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD58e5ff1a22955654aea692376feaa5f20
SHA16454581d591f6d3a144d1d1e95ce21e14eb5e502
SHA25602102acc100b9f717d2aa3fb8a9a5357680bb3d42df731474ce10234354fefdf
SHA512e9698fce960dd153077161089c57cc9d55c2d41b8b813a55ebabba9bf8fae99b04ad0890dc4c60482caa8c2571e3a7536697053db3da22e567e2b1817add296f
-
Filesize
38KB
MD5b53041d92fa67ae9cec54884c02ed269
SHA1fb2bf03273ab9ccf98019a010f9ea5a5b07b3143
SHA2567d7401fdf77f67599e0b3e842a3ef214de9d2fb6858e2b1e122c90897ccc4113
SHA51294ec338e7f5b59102cbdfccacf51c2d1a3cf48ad1f5976dd971707a0a512b5047e75e8a0b4a289a654252b5825aa9f0886d6de185913d1c96c4076205b70e113