Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
6d0a5282a3bdc5a983c8380edb8a8bc0
-
SHA1
a579395ef205096eaea3f1779369b2996b7c1d0d
-
SHA256
49bde1bdae6e086fdad0dd2aa305d28ca95a765078c77074612666ce4e53370d
-
SHA512
6982ecc4214fdb4b2d310c78ca3d80a19f5c5e1a1bafce7f1c82abeee5915be3e6e60a6190fcb99594963d151537b4695f4030b6b1c3d980e2d9359c867e79b7
-
SSDEEP
1536:hbenS1B1lQd4K5QPqfhVWbdsmA+RjPFLC+e5hQT0ZGUGf2g:hCSL1lQiNPqfcxA+HFshQTOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1132 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2376 1652 6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe 84 PID 1652 wrote to memory of 2376 1652 6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe 84 PID 1652 wrote to memory of 2376 1652 6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe 84 PID 2376 wrote to memory of 1132 2376 cmd.exe 85 PID 2376 wrote to memory of 1132 2376 cmd.exe 85 PID 2376 wrote to memory of 1132 2376 cmd.exe 85 PID 1132 wrote to memory of 3128 1132 [email protected] 86 PID 1132 wrote to memory of 3128 1132 [email protected] 86 PID 1132 wrote to memory of 3128 1132 [email protected] 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exePID:2376
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:1132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:3128
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5c2e895e61a2ea3c573549049aab98cc8
SHA1c562edfadcdf7f171695bbd308e7ef2f649c450b
SHA2562dbeaca55cf494c69e179118c0e29c9b0950a09f87b2fa6b949b25511c268cdc
SHA5127eec78e08ba91d2da63f3f22cbe4086ab587daff9164451115c06660e63998b5b3ecf5fe631ceedab4d09af944742cda502e17ec0fec231452ca0278f2f08343
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1