Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe
-
Size
79KB
-
MD5
a9684e4a138c1ce74372fc719043c220
-
SHA1
5c167304352f12d80bbe49f8da0953a2a29728c6
-
SHA256
e314bbd9f2ab114b8184a6d7dfd1b0256af86ac6c47bfc958e088df0f76677f8
-
SHA512
29998064c12be571b7f93a628a5bf7ee936da7fee935a49aa4dafb246b39dee776946d20e5f3eb7cc3d0447cb0bf2534e5dc45ef164981bbd61f18021f814ea6
-
SSDEEP
1536:zvKPrabSnIdIvOQA8AkqUhMb2nuy5wgIP0CSJ+5yhB8GMGlZ5G:zvsrabcIVGdqU7uy5w9WMyhN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4192 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4664 wrote to memory of 4672 4664 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 92 PID 4664 wrote to memory of 4672 4664 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 92 PID 4664 wrote to memory of 4672 4664 a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe 92 PID 4672 wrote to memory of 4192 4672 cmd.exe 93 PID 4672 wrote to memory of 4192 4672 cmd.exe 93 PID 4672 wrote to memory of 4192 4672 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a9684e4a138c1ce74372fc719043c220_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exePID:4672
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:4192
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:4284
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5a8bfedbf435b165d80ff5fdfde1df9de
SHA1fa0777769e69c6576dde6823ba5881888f239be5
SHA256a11ccbe8ca58b88eb3a727763c63858fea7cfa0bf3c69bf5262f672417600096
SHA512751916b87c7efb038d557e2688b0e33d498517bdb27fd5a7ded34cfb60605cc115df3cf66379fc9446597c783a023cc53fc2d321ddf9460612945ece1540f83b