Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe
-
Size
79KB
-
MD5
a9684e4a138c1ce74372fc719043c220
-
SHA1
5c167304352f12d80bbe49f8da0953a2a29728c6
-
SHA256
e314bbd9f2ab114b8184a6d7dfd1b0256af86ac6c47bfc958e088df0f76677f8
-
SHA512
29998064c12be571b7f93a628a5bf7ee936da7fee935a49aa4dafb246b39dee776946d20e5f3eb7cc3d0447cb0bf2534e5dc45ef164981bbd61f18021f814ea6
-
SSDEEP
1536:zvKPrabSnIdIvOQA8AkqUhMb2nuy5wgIP0CSJ+5yhB8GMGlZ5G:zvsrabcIVGdqU7uy5w9WMyhN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2088 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 1716 cmd.exe 1716 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 848 wrote to memory of 1716 848 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 29 PID 848 wrote to memory of 1716 848 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 29 PID 848 wrote to memory of 1716 848 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 29 PID 848 wrote to memory of 1716 848 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 29 PID 1716 wrote to memory of 2088 1716 cmd.exe 30 PID 1716 wrote to memory of 2088 1716 cmd.exe 30 PID 1716 wrote to memory of 2088 1716 cmd.exe 30 PID 1716 wrote to memory of 2088 1716 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2088
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5a8bfedbf435b165d80ff5fdfde1df9de
SHA1fa0777769e69c6576dde6823ba5881888f239be5
SHA256a11ccbe8ca58b88eb3a727763c63858fea7cfa0bf3c69bf5262f672417600096
SHA512751916b87c7efb038d557e2688b0e33d498517bdb27fd5a7ded34cfb60605cc115df3cf66379fc9446597c783a023cc53fc2d321ddf9460612945ece1540f83b