Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 19:07

General

  • Target

    0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    0f1c143977b774e1cab30bac41031740

  • SHA1

    fde58d34953105362be18953d00e3abc1e4f6bac

  • SHA256

    5d3b43c9684ae31a5c068c0cbbc54aa727e88899d920a82f59c62986f47b49ba

  • SHA512

    47ef16f7a058bc114c659f87b897746060d32355e7305c174248d4b9fec47da3df7100c103fad67619c2b7f119071424d83ccdd20f3d9a2eb19a2352fd1ad155

  • SSDEEP

    1536:hbmNRavpK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:hiNRaBNPqfcxA+HFshMOg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c [email protected]
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Users\Admin\AppData\Local\Temp\[email protected]
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 15225.exe
          4⤵
            PID:2900

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \Users\Admin\AppData\Local\Temp\[email protected]

            Filesize

            73KB

            MD5

            61b4a6f4695539b8abdf4733d9756ef0

            SHA1

            ca49b04ab8a5f8486d1b88fc3a10bfd06acbc1f6

            SHA256

            5bbb3e64641cd4f82ff2cf5c5507151bb56708bd70b22c86d13631ee5ae34864

            SHA512

            f0a16dcfc44b6ffc6a8512705c71ee6c27e9acd5ff98bb8641f4cd9be922fa56611ce28df6abf511fee7ee57ad5ff955ce78d9c116ffc8d56e9925c4bd5a0699

          • memory/1064-10-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

          • memory/2292-11-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB