Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe
-
Size
73KB
-
MD5
0f1c143977b774e1cab30bac41031740
-
SHA1
fde58d34953105362be18953d00e3abc1e4f6bac
-
SHA256
5d3b43c9684ae31a5c068c0cbbc54aa727e88899d920a82f59c62986f47b49ba
-
SHA512
47ef16f7a058bc114c659f87b897746060d32355e7305c174248d4b9fec47da3df7100c103fad67619c2b7f119071424d83ccdd20f3d9a2eb19a2352fd1ad155
-
SSDEEP
1536:hbmNRavpK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:hiNRaBNPqfcxA+HFshMOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2124 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4388 wrote to memory of 3216 4388 0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe 83 PID 4388 wrote to memory of 3216 4388 0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe 83 PID 4388 wrote to memory of 3216 4388 0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe 83 PID 3216 wrote to memory of 2124 3216 cmd.exe 84 PID 3216 wrote to memory of 2124 3216 cmd.exe 84 PID 3216 wrote to memory of 2124 3216 cmd.exe 84 PID 2124 wrote to memory of 4440 2124 [email protected] 85 PID 2124 wrote to memory of 4440 2124 [email protected] 85 PID 2124 wrote to memory of 4440 2124 [email protected] 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exePID:3216
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:4440
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD561b4a6f4695539b8abdf4733d9756ef0
SHA1ca49b04ab8a5f8486d1b88fc3a10bfd06acbc1f6
SHA2565bbb3e64641cd4f82ff2cf5c5507151bb56708bd70b22c86d13631ee5ae34864
SHA512f0a16dcfc44b6ffc6a8512705c71ee6c27e9acd5ff98bb8641f4cd9be922fa56611ce28df6abf511fee7ee57ad5ff955ce78d9c116ffc8d56e9925c4bd5a0699
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1