Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 20:36
Static task
static1
Behavioral task
behavioral1
Sample
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe
-
Size
34KB
-
MD5
18f4c4e52a20bcc4a57d96dd0a504110
-
SHA1
5783aacb5ce6f9ff47129c2e1cf7afa1e3a4acf6
-
SHA256
2ef8f43eaf5d13ecf4b5333539c0dc1c3bc48ecc1095d27facc8c9770266402b
-
SHA512
85c90fb83c7b59ec91ba43e8ac88c531c75411a55ac362fb9f84ff4003c9130714894d88e19facf16282c276a54e1d134a31a5ecb84de07766e789a4037199d7
-
SSDEEP
384:x6Lz0OyPaGPbG8FecNrgzbUFPlfRNefMfNq8U7QKWRzpeancfKykJIyfgS9/V+ib:x6Lo1RPbPFHRgzwFPlf/efMTGI8W
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\I-Worm.GiGu = "uGiG.eXe" 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe -
Drops file in System32 directory 3 IoCs
Processes:
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\GiGu.eXe 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\GiGu.eXe 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe File created C:\Windows\SysWOW64\GiGu.eml 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exedescription ioc process File created C:\Windows\uGiG.eXe 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe File opened for modification C:\Windows\uGiG.eXe 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1580 2456 WerFault.exe 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exedescription pid process target process PID 2456 wrote to memory of 1580 2456 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe WerFault.exe PID 2456 wrote to memory of 1580 2456 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe WerFault.exe PID 2456 wrote to memory of 1580 2456 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe WerFault.exe PID 2456 wrote to memory of 1580 2456 18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18f4c4e52a20bcc4a57d96dd0a504110NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 1762⤵
- Program crash