Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
078d1bc2d6c6fcb6e439a68a640169c0
-
SHA1
652c45f54a9d71dfa832c0aae07f5282dfd43a5f
-
SHA256
e89591f1413cc7dc72e6f7316a8788a2d53a153e1752b90f087921e38a497580
-
SHA512
93d7fc75bbe492eb9fb5619320350eb7fba9958c7edf69f9194fb91bdbd46adfaf9e2dd0af583713ab9e2858e9320a16440aad13ab1df366a9c9fb9d11446527
-
SSDEEP
1536:hbu8Unt0jKK5QPqfhVWbdsmA+RjPFLC+e5hx0ZGUGf2g:hs0eNPqfcxA+HFshxOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2448 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2552 cmd.exe 2552 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2552 2440 078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe 29 PID 2440 wrote to memory of 2552 2440 078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe 29 PID 2440 wrote to memory of 2552 2440 078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe 29 PID 2440 wrote to memory of 2552 2440 078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe 29 PID 2552 wrote to memory of 2448 2552 cmd.exe 30 PID 2552 wrote to memory of 2448 2552 cmd.exe 30 PID 2552 wrote to memory of 2448 2552 cmd.exe 30 PID 2552 wrote to memory of 2448 2552 cmd.exe 30 PID 2448 wrote to memory of 2460 2448 [email protected] 31 PID 2448 wrote to memory of 2460 2448 [email protected] 31 PID 2448 wrote to memory of 2460 2448 [email protected] 31 PID 2448 wrote to memory of 2460 2448 [email protected] 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:2460
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD55c24b52678463a06cb4b9c2a1522fc63
SHA1ff4988559a8efc2204e059055a0cb26106c47531
SHA2567339bd7177b14846d9cccf2b2267a9d3fcdbcc717a22964fb48d25f5f26317b8
SHA512e328e487f48eee65bc07b7196f21236362c4edfed952196d8db92644c0a3790506e139888a7a2f5afa1a6702d883020fb5d3fc440b5ed01a10716cea764b0ca5