Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe
-
Size
73KB
-
MD5
4e602246419ccca4fceee4307d905e90
-
SHA1
ff00e6093d301cd2f7ed003623f114feffc53e49
-
SHA256
3b4aad4ca58ad7370415343cf20055bfba3ed89ceb6980e6759d37fd2aa61cbb
-
SHA512
0aa44c43a931f8359e4e504c04eea4e85f0b9221030265baf5981324271f7d4cba198de3368b95c430fedd8424e39f977dda278631f6d2511c5c1af545bf31c7
-
SSDEEP
1536:hbwAWbc9YK5QPqfhVWbdsmA+RjPFLC+e5hw0ZGUGf2g:hEeeNPqfcxA+HFshwOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1436 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2032 4656 4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe 82 PID 4656 wrote to memory of 2032 4656 4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe 82 PID 4656 wrote to memory of 2032 4656 4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe 82 PID 2032 wrote to memory of 1436 2032 cmd.exe 83 PID 2032 wrote to memory of 1436 2032 cmd.exe 83 PID 2032 wrote to memory of 1436 2032 cmd.exe 83 PID 1436 wrote to memory of 4788 1436 [email protected] 84 PID 1436 wrote to memory of 4788 1436 [email protected] 84 PID 1436 wrote to memory of 4788 1436 [email protected] 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e602246419ccca4fceee4307d905e90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\cmd.exePID:2032
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:1436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:4788
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD57ab0fdccc63ff4b737a113f6ecde5a68
SHA19301a3d3fe06361a8214cc349d9df8ce3cea15a8
SHA2561da250959dc41bc418db73493db079f05c8d7ac810299ba88d1df2bf1e4196cf
SHA51206340af1b8620feb46aa2eb394f8de3074cab744635e4ffde67323b3d1d94d03a660884b66efe1a62c7ae8152d1820ccc4d508b48a417e437a7bb347b2c7ee94
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1