Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 02:27
Behavioral task
behavioral1
Sample
2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
2eed1647effbe8446c7259e33f72bcb0
-
SHA1
50a024d8171d57b26c9d88c75254fcc3edbbe053
-
SHA256
0741a42bba65812fbeab02d6e7c8f076cf380ccf6601e9f7fc788aadc2f1d6ce
-
SHA512
f0b9b925ef6a8de0a87f167920984403d8c29a9fb9c50d2c613cac1f5219930ab8ffea32a0f5fd7b40d06533089c24d04a45ec3b6426d64a71ad426165faf0bb
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/TQyFPE:E5aIwC+Agr6SqCPGvTG
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023409-21.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/448-15-0x0000000002FD0000-0x0000000002FF9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe Token: SeTcbPrivilege 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 448 2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 1756 448 2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe 83 PID 448 wrote to memory of 1756 448 2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe 83 PID 448 wrote to memory of 1756 448 2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe 83 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 1756 wrote to memory of 4268 1756 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 84 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 2720 wrote to memory of 2796 2720 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 95 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 PID 436 wrote to memory of 4256 436 2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe 97 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2eed1647effbe8446c7259e33f72bcb0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Roaming\WinSocket\2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4268
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:2796
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\2eed1748effbe9447c8269e33f82bcb0_NeikiAnalytict.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52eed1647effbe8446c7259e33f72bcb0
SHA150a024d8171d57b26c9d88c75254fcc3edbbe053
SHA2560741a42bba65812fbeab02d6e7c8f076cf380ccf6601e9f7fc788aadc2f1d6ce
SHA512f0b9b925ef6a8de0a87f167920984403d8c29a9fb9c50d2c613cac1f5219930ab8ffea32a0f5fd7b40d06533089c24d04a45ec3b6426d64a71ad426165faf0bb
-
Filesize
43KB
MD5b5493312b07cba1a57ffecd2c338128f
SHA18102a02cc0927fc5aa68b3be403c9f74894ceebc
SHA2568a7bfc321026fa5db4742b58a66916a17760f48a8a5a9c84b9327e6e650780ee
SHA512ddc362ec3e2d18f6a6fd267141f8125af8aaed57d174c26eb3d84944ed887ac71a90e1e1e59712ffca4d6630d2c7fb57089be83e75ead31d9dae88d42f7426c8