Analysis

  • max time kernel
    134s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 19:07

General

  • Target

    0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    0f1c143977b774e1cab30bac41031740

  • SHA1

    fde58d34953105362be18953d00e3abc1e4f6bac

  • SHA256

    5d3b43c9684ae31a5c068c0cbbc54aa727e88899d920a82f59c62986f47b49ba

  • SHA512

    47ef16f7a058bc114c659f87b897746060d32355e7305c174248d4b9fec47da3df7100c103fad67619c2b7f119071424d83ccdd20f3d9a2eb19a2352fd1ad155

  • SSDEEP

    1536:hbmNRavpK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:hiNRaBNPqfcxA+HFshMOg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0f1c143977b774e1cab30bac41031740_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c [email protected]
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Users\Admin\AppData\Local\Temp\[email protected]
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 00.exe
          4⤵
            PID:4440

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\[email protected]

            Filesize

            73KB

            MD5

            61b4a6f4695539b8abdf4733d9756ef0

            SHA1

            ca49b04ab8a5f8486d1b88fc3a10bfd06acbc1f6

            SHA256

            5bbb3e64641cd4f82ff2cf5c5507151bb56708bd70b22c86d13631ee5ae34864

            SHA512

            f0a16dcfc44b6ffc6a8512705c71ee6c27e9acd5ff98bb8641f4cd9be922fa56611ce28df6abf511fee7ee57ad5ff955ce78d9c116ffc8d56e9925c4bd5a0699

          • C:\Users\Admin\AppData\Local\Temp\00.exe

            Filesize

            2KB

            MD5

            7b621943a35e7f39cf89f50cc48d7b94

            SHA1

            2858a28cf60f38025fffcd0ba2ecfec8511c197d

            SHA256

            bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

            SHA512

            4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

          • memory/2124-7-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

          • memory/4388-8-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB