Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 18:27

General

  • Target

    078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    078d1bc2d6c6fcb6e439a68a640169c0

  • SHA1

    652c45f54a9d71dfa832c0aae07f5282dfd43a5f

  • SHA256

    e89591f1413cc7dc72e6f7316a8788a2d53a153e1752b90f087921e38a497580

  • SHA512

    93d7fc75bbe492eb9fb5619320350eb7fba9958c7edf69f9194fb91bdbd46adfaf9e2dd0af583713ab9e2858e9320a16440aad13ab1df366a9c9fb9d11446527

  • SSDEEP

    1536:hbu8Unt0jKK5QPqfhVWbdsmA+RjPFLC+e5hx0ZGUGf2g:hs0eNPqfcxA+HFshxOg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c [email protected]
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Users\Admin\AppData\Local\Temp\[email protected]
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 00.exe
          4⤵
            PID:2460

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\[email protected]

      Filesize

      73KB

      MD5

      5c24b52678463a06cb4b9c2a1522fc63

      SHA1

      ff4988559a8efc2204e059055a0cb26106c47531

      SHA256

      7339bd7177b14846d9cccf2b2267a9d3fcdbcc717a22964fb48d25f5f26317b8

      SHA512

      e328e487f48eee65bc07b7196f21236362c4edfed952196d8db92644c0a3790506e139888a7a2f5afa1a6702d883020fb5d3fc440b5ed01a10716cea764b0ca5

    • memory/2440-11-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2448-10-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB