Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe
-
Size
79KB
-
MD5
4d2739714ff283767c979dfdc0abaa00
-
SHA1
e01955e4f7a65d96bccee0b043b76a815905278c
-
SHA256
7ef05dcea3a86aa40f14678fe3389d8bece50a385d2a18028599a03de4905c2c
-
SHA512
bdad3091f5eef46ce44668c194f2291e51c3d9037a067cd8e8bfc9883fc3fd8e515a44f98340cba3e102895a98ff355858d5922884df85b513905279b74607e6
-
SSDEEP
1536:zveCNhYfGI1hzeX5kW6OQA8AkqUhMb2nuy5wgIP0CSJ+5yAB8GMGlZ5G:zvbhZIjeRPGdqU7uy5w9WMyAN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2636 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 1980 cmd.exe 1980 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1860 wrote to memory of 1980 1860 4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe 29 PID 1860 wrote to memory of 1980 1860 4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe 29 PID 1860 wrote to memory of 1980 1860 4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe 29 PID 1860 wrote to memory of 1980 1860 4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe 29 PID 1980 wrote to memory of 2636 1980 cmd.exe 30 PID 1980 wrote to memory of 2636 1980 cmd.exe 30 PID 1980 wrote to memory of 2636 1980 cmd.exe 30 PID 1980 wrote to memory of 2636 1980 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d2739714ff283767c979dfdc0abaa00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2636
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5b0c8bae7ec995ca8756aa80d8b97bdf7
SHA1fe869be641a69418be80bb5e148182b078ffc35e
SHA256cd08a246e1e20fc68574c37cc9e1c56cf77cc15bb5da8fc9830e7beba8b80f6b
SHA512d311f4195117b7dbcd07694a1a1928a8d758d16618a1f338aa1625706c7fef64bccf6b13ce8367217624a79c70f7cc5383786d4e9b457a1f9a017d9b434340dd