Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 11:39
Behavioral task
behavioral1
Sample
58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe
-
Size
134KB
-
MD5
58b672f36e71251b2192f2e19baec830
-
SHA1
25051d80782fa6cda0c17b43fe072622e7cbc8b9
-
SHA256
3c621489d42f95481cd99461ba5d9d88eb6767f3fbdd0481001aaa81bd4ce196
-
SHA512
83634cfdd3d5fed6a01e8bd05074b802cf5021c1ed50d8fb09e6ca968876c4cf7e6155ce8fed80010d5004df5f91dcace5e13d35b62d391a0d715fcc3f7fbcc2
-
SSDEEP
1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SOl:YfU/WF6QMauSuiWNi9eNOl0007NZIOl
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2724 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2852 wuauclt.exe -
Loads dropped DLL 1 IoCs
pid Process 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1688-0-0x00000000000E0000-0x0000000000108000-memory.dmp upx behavioral1/files/0x0035000000016d61-2.dat upx behavioral1/memory/2852-7-0x00000000012C0000-0x00000000012E8000-memory.dmp upx behavioral1/memory/1688-8-0x00000000000E0000-0x0000000000108000-memory.dmp upx behavioral1/memory/2852-10-0x00000000012C0000-0x00000000012E8000-memory.dmp upx behavioral1/memory/1688-11-0x00000000000E0000-0x0000000000108000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run" 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2852 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2852 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2852 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2852 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 28 PID 1688 wrote to memory of 2724 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 29 PID 1688 wrote to memory of 2724 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 29 PID 1688 wrote to memory of 2724 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 29 PID 1688 wrote to memory of 2724 1688 58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\ProgramData\Update\wuauclt.exe"C:\ProgramData\Update\wuauclt.exe" /run2⤵
- Executes dropped EXE
PID:2852
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\58b672f36e71251b2192f2e19baec830_NeikiAnalytics.exe" >> NUL2⤵
- Deletes itself
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD53e83afc4c793c0e7284cae4d2cecb15c
SHA1a4195af9d36fee4457ebf13902fc0496713ff632
SHA25688521442944a61003028ff638fb4ba395ef7017e863beb12fd70b0ee19ee2168
SHA512e1570446e36dbe48f0ff3b4815817988e2646c629f305a28de352a0505478b2bc32527610a1d3a58edbf06f1b8b9874a379ccb3c2d24f321703b2ef2cc9261b9