53b84989e9478e90960e8aa69127f56cce6fcbfc5406a008ae42471c949c614d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe
Size

928KB
MD5

1ad098ff180cdec1ef320c666c931650
SHA1

93fb520b4fa31783699e8035efeac920306b9d60
SHA256

53b84989e9478e90960e8aa69127f56cce6fcbfc5406a008ae42471c949c614d
SHA512

edee9f2a2c420b9485064e2ff4bcdc884bf7aebc0f9cd512f4ae6825f067630dc70ef217fe7fddc07b2abb5b200b7132cfa200318885fa3a6dfc4d3a943b3c0f
SSDEEP

24576:UdlsaUea64xHvqh5AZo8UUMpvATxCPV8DXTFDSAdEELdDDDCDaD3fXN0VI5sPSTd:Udlva64xHSh5AZo8UUM5MxCPVuXTFDSu

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2728	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2728	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2728	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1688	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2728	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2728	1688	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe	29
PID 1688 wrote to memory of 2728	1688	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe	29
PID 1688 wrote to memory of 2728	1688	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe	29
PID 1688 wrote to memory of 2728	1688	1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1ad098ff180cdec1ef320c666c931650_NeikiAnalytics.exe

Filesize
928KB

MD5
06a5d48aaf226ffb71ba1954506007b0

SHA1
aec7c3103bead9de4dfba68c64fcbaa8c5b5cfcf

SHA256
b5f7b9756a5645cf3caeff5d7c2d06e1b5229718b1103a9f9aef08792685db4e

SHA512
07ab41934153f9e08dba1bcfc24c7512c032389cd73baea931417f8e1ce2a0e5602a867d9920c84a7b234508bfb56561802fa087bfdc22fcd79cc505123f4618

Download Submit
memory/1688-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1688-6-0x0000000003090000-0x000000000317F000-memory.dmp

Filesize
956KB

Download
memory/1688-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2728-9-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2728-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2728-17-0x0000000002E60000-0x0000000002F4F000-memory.dmp

Filesize
956KB

Download
memory/2728-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2728-39-0x000000000FE40000-0x000000000FEE3000-memory.dmp

Filesize
652KB

Download