Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 13:09
Static task
static1
Behavioral task
behavioral1
Sample
9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe
-
Size
225KB
-
MD5
9d50d0cb5dec5e151ad2a45a194315e0
-
SHA1
81c450ecd1f805e5a99c7d273932f1488e84927d
-
SHA256
31f74a0058bfdeb064ca3094bfbf7d18956ca2a8a4d9852cbd0a8eaff5fe17ae
-
SHA512
6c173c2dfa86b5b70b2eb9814103aa7f854351292b44928fa09f037b046c0d32a614d6c44e71717ccf3b2c7f6862a96a586224550050a8d781a370387398d4ad
-
SSDEEP
6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\8B43E9CD = "C:\\Users\\Admin\\AppData\\Roaming\\8B43E9CD\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
winver.exepid process 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe 2484 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2484 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exewinver.exedescription pid process target process PID 1548 wrote to memory of 2484 1548 9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe winver.exe PID 1548 wrote to memory of 2484 1548 9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe winver.exe PID 1548 wrote to memory of 2484 1548 9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe winver.exe PID 1548 wrote to memory of 2484 1548 9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe winver.exe PID 1548 wrote to memory of 2484 1548 9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe winver.exe PID 2484 wrote to memory of 1200 2484 winver.exe Explorer.EXE PID 2484 wrote to memory of 1116 2484 winver.exe taskhost.exe PID 2484 wrote to memory of 1172 2484 winver.exe Dwm.exe PID 2484 wrote to memory of 1200 2484 winver.exe Explorer.EXE PID 2484 wrote to memory of 1548 2484 winver.exe 9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9d50d0cb5dec5e151ad2a45a194315e0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1116-11-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/1116-23-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/1172-24-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1172-14-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1200-3-0x0000000002A60000-0x0000000002A66000-memory.dmpFilesize
24KB
-
memory/1200-6-0x0000000002A60000-0x0000000002A66000-memory.dmpFilesize
24KB
-
memory/1200-1-0x0000000002A60000-0x0000000002A66000-memory.dmpFilesize
24KB
-
memory/1200-17-0x0000000002AD0000-0x0000000002AD6000-memory.dmpFilesize
24KB
-
memory/1200-25-0x0000000002AD0000-0x0000000002AD6000-memory.dmpFilesize
24KB
-
memory/1548-8-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2484-4-0x0000000000100000-0x0000000000106000-memory.dmpFilesize
24KB
-
memory/2484-22-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/2484-27-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB