Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 09:23
Behavioral task
behavioral1
Sample
4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
-
Size
7.5MB
-
MD5
4f0b17d2b23a5c668e50a8c95079bba0
-
SHA1
bb9475598efddd38f177ef8131ff243c162deef5
-
SHA256
a21086776cba10e3ca93ad3d96b08fab8c131869a14819c9d88af601fd5e97c7
-
SHA512
ce7e8b432e6e426344dc54fd06235084f65c25ad4ef2aaed43ef5f0c5c6d41b6b79031e5c97115cf92b67feb6d9fc7dc2833476555a8e76336d83d62eea9198e
-
SSDEEP
196608:i7u+sxfCurErvI9pWjgU1DEzx7sKL/s1tYAkjrWlRHes:PXxfCurEUWjhEhn01t+49
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exepid process 2504 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI18882\python312.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exedescription pid process target process PID 1888 wrote to memory of 2504 1888 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe PID 1888 wrote to memory of 2504 1888 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe PID 1888 wrote to memory of 2504 1888 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe 4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"2⤵
- Loads dropped DLL
PID:2504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5cbd02b4c0cf69e5609c77dfd13fba7c4
SHA1a3c8f6bfd7ffe0783157e41538b3955519f1e695
SHA256ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5
SHA512a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567