Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 04:21

General

  • Target

    76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll

  • Size

    38KB

  • MD5

    76e213da78ba8bfd0b65e9ff9b6c5b70

  • SHA1

    d7e47a874ca1d396ae09534f3cee3fd66919466a

  • SHA256

    ab6740bda183a9355a14c3e39439dd6286acd8cd9969f7ae337b8a94cebfad85

  • SHA512

    a745c75a335283766f0cc6f6a794466dc7711183dee948ef6be300c7f8f0f8cab342b5c0b1d0dc81a0354a8ffd0a3ee65a9d9c237c2ce14cb6eb9d4708fa26f0

  • SSDEEP

    768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV70IXUi6m2sSwVV:WD8w22laSR0V+3CJrVLXpzJS

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\76e213da78ba8bfd0b65e9ff9b6c5b70_NeikiAnalytics.dll,#1
      2⤵
      • Drops file in System32 directory
      PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2236-2-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2236-1-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2236-0-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB