Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 07:29
Behavioral task
behavioral1
Sample
92ae0db2574f133269f27498b3745200_NeikiAnalytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
92ae0db2574f133269f27498b3745200_NeikiAnalytics.dll
Resource
win10v2004-20240226-en
General
-
Target
92ae0db2574f133269f27498b3745200_NeikiAnalytics.dll
-
Size
73KB
-
MD5
92ae0db2574f133269f27498b3745200
-
SHA1
4c0173388007ec491cea2d9c7c48fb7224c392cf
-
SHA256
19231df441e959dbf943a3cb5f04585a9c24c31f2445e5ef6b77b2ef1be9955c
-
SHA512
f2c7d74c8a2023235e37462bd9d2e75148a1177059c3efb6ff9355c9b6254544158b28dbdc50b135ceb14c334111e83db5104d98b060b57931d496daecf6b8e4
-
SSDEEP
1536:UZZZZZZZZZZZZpXzzzzzzzzzzzzfP2PIFYa09P6+KIB6YyzMqqU+2bbbAV2/S2s3:07FYb6+KIPIMqqDL2/sEvdCNd
Malware Config
Signatures
-
GandCrab payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-0-0x0000000000140000-0x0000000000157000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe PID 2072 wrote to memory of 1736 2072 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92ae0db2574f133269f27498b3745200_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92ae0db2574f133269f27498b3745200_NeikiAnalytics.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-0-0x0000000000140000-0x0000000000157000-memory.dmpFilesize
92KB