5870a469b0af9c6144d262ce78a1ab5293ad66c11510058ce12cfa296cfc6cd6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
Size

3.4MB
MD5

941a42f6b8c997962779afaa07ff77b0
SHA1

a0aee8b63743533aaf23d80315805f094200a31f
SHA256

5870a469b0af9c6144d262ce78a1ab5293ad66c11510058ce12cfa296cfc6cd6
SHA512

a50d6f6dc74e59c4270051813a9d5ff0a284c0e9997997aa4d2c262c3eb9aa652b18a2f035036ad21e20d16ad8e93b5a69ea47394716315892c0c063438d70c8
SSDEEP

49152:R5qwqr0Ig7grNZbNsm+kwjI4TT86lorVlyR0WsgygRbNsm+kwjFvy:Hpq5NZZshK4n86WrWD3Zshfvy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1032	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1032	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2328	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1032	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2328	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1032	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1032	2328	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe	29
PID 2328 wrote to memory of 1032	2328	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe	29
PID 2328 wrote to memory of 1032	2328	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe	29
PID 2328 wrote to memory of 1032	2328	941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe

Filesize
3.4MB

MD5
3c9f3955d31ae9c0e3b358686347686c

SHA1
46b81cba556859474e56fb93d0122fa5894e48db

SHA256
195c58c3baf6ef712c1f28ffc80f45af40df2ef9d8eb6ad47edee602734cebd6

SHA512
8ba6c3fabab77ecb8f8b164d5b55ca7724e69ab98ec7f870898d788c73d53460e549870688cc7e52d366d51479fcd2e4178e17b73ef27dfd8419e4a673f06887

Download Submit
memory/1032-9-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1032-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/1032-16-0x0000000002F60000-0x0000000003077000-memory.dmp

Filesize
1.1MB

Download
memory/1032-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1032-38-0x000000000EEE0000-0x000000000EF83000-memory.dmp

Filesize
652KB

Download
memory/2328-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2328-7-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download