adae2f147cd1b9b2f48ada429ae9162c23234541466a0f26b85c74bb1302f9d5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe
Size

3.0MB
MD5

4959a0f004b6451a3cf63039a2870b60
SHA1

136de801f6802c1afa62c144d12b73a69c91deab
SHA256

adae2f147cd1b9b2f48ada429ae9162c23234541466a0f26b85c74bb1302f9d5
SHA512

5caa8e5c013b0ec19426183ce530fe2567af3502500aa9b3ed3f68811ca47beaf30dba399beb41a3879f7c3b9117bb23cf5e9a28f25b2cdedb14590262d5cab1
SSDEEP

98304:IchA/YvcFtaEkQQQAEXytvZi8eue8RQQW/:IwA/YvcFtaEkQpOfpa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2928	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2928	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2204	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
3	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2204	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2928	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2928	2204	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe	29
PID 2204 wrote to memory of 2928	2204	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe	29
PID 2204 wrote to memory of 2928	2204	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe	29
PID 2204 wrote to memory of 2928	2204	4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\4959a0f004b6451a3cf63039a2870b60_NeikiAnalytics.exe

Filesize
3.0MB

MD5
e04f41df89bfffe5a758f74a0e7c0a74

SHA1
56040e248312e88e4c929dc4adb6b10b1b59adcc

SHA256
8439fda5d5976e91dbe36041fabc1578242573292d1af21f98460387cf8578f6

SHA512
11b97bda536e2fa0108f82b5f9ca741e9f309983ca63d59d1a0995bf0cfe17dc130cb166ec2f2d34314c9f0328d6a95a5d715dcb2f6b285d1a80033f1c129dbb

Download Submit
memory/2204-0-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2204-6-0x0000000003450000-0x0000000003541000-memory.dmp

Filesize
964KB

Download
memory/2204-9-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2928-10-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/2928-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2928-17-0x0000000002E10000-0x0000000002F01000-memory.dmp

Filesize
964KB

Download
memory/2928-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2928-39-0x000000000EE70000-0x000000000EF13000-memory.dmp

Filesize
652KB

Download