Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 10:17
Behavioral task
behavioral1
Sample
c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe
-
Size
45KB
-
MD5
c91cba1eef413febb2f0387c37c1f950
-
SHA1
b60091916937639d5d96fda8e3076da93ab21e59
-
SHA256
69ae78f003483214915bfa9b8502affbf52d2f98195e74a73c7843d17f0e2479
-
SHA512
a219c3c3ed321dc0f3d208f064b3311c78491fed145f46b61bc86dbaf75b8485b5871d790c7c7ce77c47a1fa5132111123ad3ab17b2455dbb6bcaf56c14a9f8d
-
SSDEEP
768:yhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:+sWE9N5dFu53dsniQaB/xZ14n7zIF+qr
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1792-0-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\A162226A = "C:\\Users\\Admin\\AppData\\Roaming\\A162226A\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe 2200 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2200 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exewinver.exedescription pid process target process PID 1792 wrote to memory of 2200 1792 c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe winver.exe PID 1792 wrote to memory of 2200 1792 c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe winver.exe PID 1792 wrote to memory of 2200 1792 c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe winver.exe PID 1792 wrote to memory of 2200 1792 c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe winver.exe PID 1792 wrote to memory of 2200 1792 c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe winver.exe PID 2200 wrote to memory of 1204 2200 winver.exe Explorer.EXE PID 2200 wrote to memory of 1092 2200 winver.exe taskhost.exe PID 2200 wrote to memory of 1168 2200 winver.exe Dwm.exe PID 2200 wrote to memory of 1204 2200 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c91cba1eef413febb2f0387c37c1f950_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-23-0x0000000077CD1000-0x0000000077CD2000-memory.dmpFilesize
4KB
-
memory/1092-22-0x0000000000210000-0x0000000000216000-memory.dmpFilesize
24KB
-
memory/1168-19-0x0000000001DA0000-0x0000000001DA6000-memory.dmpFilesize
24KB
-
memory/1168-25-0x0000000001DA0000-0x0000000001DA6000-memory.dmpFilesize
24KB
-
memory/1204-4-0x0000000002530000-0x0000000002536000-memory.dmpFilesize
24KB
-
memory/1204-3-0x0000000002530000-0x0000000002536000-memory.dmpFilesize
24KB
-
memory/1204-2-0x0000000002530000-0x0000000002536000-memory.dmpFilesize
24KB
-
memory/1204-24-0x00000000024D0000-0x00000000024D6000-memory.dmpFilesize
24KB
-
memory/1204-10-0x0000000077CD1000-0x0000000077CD2000-memory.dmpFilesize
4KB
-
memory/1204-21-0x00000000024D0000-0x00000000024D6000-memory.dmpFilesize
24KB
-
memory/1792-5-0x0000000001DB0000-0x00000000027B0000-memory.dmpFilesize
10.0MB
-
memory/1792-12-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1792-13-0x0000000001DB0000-0x00000000027B0000-memory.dmpFilesize
10.0MB
-
memory/1792-0-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1792-1-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2200-6-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/2200-7-0x0000000077E80000-0x0000000077E81000-memory.dmpFilesize
4KB
-
memory/2200-8-0x0000000077E7F000-0x0000000077E80000-memory.dmpFilesize
4KB
-
memory/2200-9-0x0000000077E7F000-0x0000000077E81000-memory.dmpFilesize
8KB
-
memory/2200-11-0x0000000077C80000-0x0000000077E29000-memory.dmpFilesize
1.7MB
-
memory/2200-29-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB