Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
388b4ddf4aa8a8077b820aa4b8ccd8e0
-
SHA1
23772925327b32051df985011f5742717e96fffa
-
SHA256
af80572a06f545033a93cb4a85f8113fcf5842da61e416db4373f1ac2dedd95d
-
SHA512
29863d79ee4b8c258a5173f3f0ae67e1fcf26e7199969563f72f640d6c884b5286bacee48132182314892f1040b898491cb4ed6aefef98b300c65e54573f0904
-
SSDEEP
1536:zvBhcIFGoQftrSOQA8AkqUhMb2nuy5wgIP0CSJ+5yeB8GMGlZ5G:zvqrXGdqU7uy5w9WMyeN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5112 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4076 1892 388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe 83 PID 1892 wrote to memory of 4076 1892 388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe 83 PID 1892 wrote to memory of 4076 1892 388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe 83 PID 4076 wrote to memory of 5112 4076 cmd.exe 84 PID 4076 wrote to memory of 5112 4076 cmd.exe 84 PID 4076 wrote to memory of 5112 4076 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exePID:4076
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:5112
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5973867665c78ab39798ed67030b05de0
SHA16872ccee2e76a920a3d44c704a21dc70244b6dbf
SHA256269195ba3019ae039635bded387945355c249b26b4f90668ea11f23418d400b1
SHA51233a12d76cebeba41aaf673c4c8df9b04adf8fadb32f725c946f3f9bf35c80c553c411aa87b85009f93cbf2b4fa53fb0d396213fc9e9e0c1bb34d9a4786e01375