Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 12:13
Behavioral task
behavioral1
Sample
e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
e1caefc11f36048b4d3998e26c0c8140
-
SHA1
80d82492c25fe821f589d211d324bf05d18b399d
-
SHA256
25a424ecc5f426c420bce4c5ae1814bc5b705d2e1d453c25b8d4631ea5608a6d
-
SHA512
30dd8ad9bf4b8f6af32dfcace79dbe1f2eddd62c908cdc4f6d5baca419ccfb529d7857063d5a00addc5fae999b3bf5e262a52d01afdbb1523c87d918fc657ff3
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wn+q:E5aIwC+Agr6StVEnmcKxY/O1pq
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x000700000002341a-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/1804-15-0x0000000002C10000-0x0000000002C39000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe Token: SeTcbPrivilege 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1804 e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 1184 1804 e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe 82 PID 1804 wrote to memory of 1184 1804 e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe 82 PID 1804 wrote to memory of 1184 1804 e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe 82 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1184 wrote to memory of 3940 1184 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 83 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 1056 wrote to memory of 1168 1056 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 98 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 PID 2440 wrote to memory of 3756 2440 e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3940
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:1168
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\e1caefc11f37049b4d3999e27c0c9140_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:3756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e1caefc11f36048b4d3998e26c0c8140
SHA180d82492c25fe821f589d211d324bf05d18b399d
SHA25625a424ecc5f426c420bce4c5ae1814bc5b705d2e1d453c25b8d4631ea5608a6d
SHA51230dd8ad9bf4b8f6af32dfcace79dbe1f2eddd62c908cdc4f6d5baca419ccfb529d7857063d5a00addc5fae999b3bf5e262a52d01afdbb1523c87d918fc657ff3
-
Filesize
21KB
MD5622f83f4b90148ce93d402e8ca0f7e7f
SHA17c142b16f31296b83b42af19be2dca6b6d894b7a
SHA25617d0bc2d8c993269b7ca43bde6715c44a82d65b0bc79ed87f952cd3151a49148
SHA51228edccff1c0b490197ab2f6545ed56abef5d96973d351201c18543e03419aa9d930521b2f5fea2dfacafdbe6473bbae7810bb0d0c6ffc0738f1983e4fdefa575