Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
-
Size
3.4MB
-
MD5
941a42f6b8c997962779afaa07ff77b0
-
SHA1
a0aee8b63743533aaf23d80315805f094200a31f
-
SHA256
5870a469b0af9c6144d262ce78a1ab5293ad66c11510058ce12cfa296cfc6cd6
-
SHA512
a50d6f6dc74e59c4270051813a9d5ff0a284c0e9997997aa4d2c262c3eb9aa652b18a2f035036ad21e20d16ad8e93b5a69ea47394716315892c0c063438d70c8
-
SSDEEP
49152:R5qwqr0Ig7grNZbNsm+kwjI4TT86lorVlyR0WsgygRbNsm+kwjFvy:Hpq5NZZshK4n86WrWD3Zshfvy
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1032 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1032 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Loads dropped DLL 1 IoCs
pid Process 2328 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 pastebin.com 4 pastebin.com -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1032 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2328 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1032 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1032 2328 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 29 PID 2328 wrote to memory of 1032 2328 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 29 PID 2328 wrote to memory of 1032 2328 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 29 PID 2328 wrote to memory of 1032 2328 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD53c9f3955d31ae9c0e3b358686347686c
SHA146b81cba556859474e56fb93d0122fa5894e48db
SHA256195c58c3baf6ef712c1f28ffc80f45af40df2ef9d8eb6ad47edee602734cebd6
SHA5128ba6c3fabab77ecb8f8b164d5b55ca7724e69ab98ec7f870898d788c73d53460e549870688cc7e52d366d51479fcd2e4178e17b73ef27dfd8419e4a673f06887