Analysis
-
max time kernel
129s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 18:33
Behavioral task
behavioral1
Sample
3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
3885ab0ba1f5696660edb2ff83f748f0
-
SHA1
9111c9ac9aae58821902c702d9c6cfa40a80635e
-
SHA256
31d83642449bc805b39c3c96ede7eb92b0c1fe96e8e80a3668452549d9448bf9
-
SHA512
f256e73c28c9ed0f4bb75bb0882f68c8a4920a3c31ef62f1a8943e089399551634643960dd84dee4a478d06244c33759136802698c2a813df712f3728d0b3bb7
-
SSDEEP
24576:VaPnAOx5SUXJW/D4xUa38vKdTIkpgSWC+osF0jzZVb+t35cMYlG96NMBJMncaMvT:V0x5SUW/cxUitIGLsF0nb+tJVYleAMzH
Malware Config
Extracted
metasploit
windows/download_exec
http://2dbd-103-21-170-170.ngrok.io:80/Hth8
- headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1504 4948 WerFault.exe 3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe 5092 4948 WerFault.exe 3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3885ab0ba1f5696660edb2ff83f748f0_NeikiAnalytics.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 15402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 15162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4948 -ip 49481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4948 -ip 49481⤵