Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 20:25
Behavioral task
behavioral1
Sample
a2f32690a1d65add45baaa207d1e0890_NeikiAnalytics.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
a2f32690a1d65add45baaa207d1e0890_NeikiAnalytics.dll
-
Size
68KB
-
MD5
a2f32690a1d65add45baaa207d1e0890
-
SHA1
484d4d561c7afe1b9770d645aa63793b70030fdb
-
SHA256
5c719001aab4b676ab6a0819ec3fd42c340c9d32043c0785b5af16da45aadfe1
-
SHA512
fdc1e4fc139ec149b546e194949d5f81ac215b69fb0d6981f9c858de9e785a6d32bc65464ad69f26decd4adca7b9414b7443cae12d5bb13252f9839c3bfd3775
-
SSDEEP
1536:MLNd/Pk7btaoX7DypKr0wNNYIUSS9eyBx20iZs3w:GNhY5aora80mNYI7+2Xs3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\avfnqfsu.exe rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe PID 2180 wrote to memory of 2040 2180 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2f32690a1d65add45baaa207d1e0890_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2f32690a1d65add45baaa207d1e0890_NeikiAnalytics.dll,#12⤵
- Drops startup file
PID:2040
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2040-0-0x0000000010000000-0x0000000010014000-memory.dmpFilesize
80KB