Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27/05/2024, 23:37 UTC
General
-
Target
2748d423314876f9cebbadacc1360930_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
2748d423314876f9cebbadacc1360930
-
SHA1
c6941c346b8b4cb362b231f073b5763852995d74
-
SHA256
7db61eedc512dcc3d726a171debf6d14d6feebac562d86ad8a3c634a96452925
-
SHA512
e37d5d0c3d8bc6512ba80d73403ac2d1e2125120b22f78ac1b39cee2529844f0319a4f01a3156673703fc357750048e6c22893f34925d0eea566c68138397362
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBj9w4Sx:+R0pI/IQlUoMPdmpSpr4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2748d423314876f9cebbadacc1360930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2748d423314876f9cebbadacc1360930_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\FilesKT\devdobloc.exeC:\FilesKT\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD580402fd43322ee8e9505bdca620bc871
SHA18d8c033b2851d5c4b81c86b161887fb8a92396c4
SHA256c95b483308ef508d3b08aa062f57d0e8cd117ce657c8f9ddf646e18f05d70cdc
SHA512a9bae6e32da9983d31973a7b2f707b7d90c163a4253a3b0c9c32aa9163e0dd547d9521e45e9eb08ef7c57a9243ac2dc4c46de87284e6e1b747f3f3cf8d59ed8e
-
Filesize
203B
MD5a22e1b68cbf5046517f2942c88d47f16
SHA1ba89435351c6efc1eda9bc91dde1c838d2245047
SHA25651d4ca167d90c5e42c09e1fa63f5a3ff195f0696a3df81092f0ad3d7b180b5dc
SHA5129bd62cf201cacbf25f4ec1daebf3892fcf21ff2a33ce066b4b3594f8f958ad7246e1d8fbe08f263b8cefb413eaa36a142a185b478f0e1e3bce511753839527d8
-
Filesize
2.7MB
MD5283df332615705f554337b11bb2a808f
SHA18f39a7136c77eb7379dcb64c6e2ce91bc6bd11fe
SHA25672be4c337d10894e7af3c6443437a17a6452c2c9e361418df28d1ccee79ca044
SHA5124b84fdb29c6e3378902c8c61ed666793055e69a4cea3ed5d274c90e47c6830393c99b74671017af1129a91e16364a78e1534ebdcb6ba768e81254cf8aff1fa98