Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
02/06/2024, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe
Resource
win7-20240508-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
- Target 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe
- Size 4.8MB
- Sample240602-2fbh3shd5x
- SHA256 449abf5a1461a359801fd8e2b0aaf17b3349f038caf341bf38975ef8c13814ad
- MD5 77264b0d3445f0f14f6044f56b530270
- SHA1 a94d5b3588d98502688d3e9dbaa55de87f6f4ce0
- SHA512 8308ee5f641ed11e016a99995d1a060088c4d77e23c7e357a3c790358775cbef9aff46435c9cbd76c14d92f1cd53559a82bce405f1779182640e7415c74959da
- SSDEEP 98304:emhd1UryeLeHbrngY72Z7V7wQqZUha5jtSyR:elSH/gY72Z72QbaZtlR
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2240 1F72.tmp - Executes dropped EXE 1 IoCs
pid Process 2240 1F72.tmp - Loads dropped DLL 2 IoCs
pid Process 2244 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe 2244 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2240 2244 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2240 2244 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2240 2244 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2240 2244 77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp" --splashC:\Users\Admin\AppData\Local\Temp\77264b0d3445f0f14f6044f56b530270_NeikiAnalytics.exe D4D6A7C0F21D3330E219AF7EA941031069CFA40380006B83304431F6A232E2D64ADB03DBDC386A1F82DB4C9F595044A8E8DF4F9F8456BD16FF4A4F499C0F9ADA2⤵
- Deletes itself
- Executes dropped EXE
PID:2240
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\1F72.tmp
- Size 4.8MB
- SHA256 07905c5c147a5fc1cdb7b6d30daf7cab71dadc90cc56c3b9b9ca17befbd7cc2d
- MD5 9886d1fcd90b8dad8eacee9112c05c9a
- SHA1 b13a12db531401330c222f445ac75813d3e5d2de
- SHA512 03ab46d8de62726c2d4a33632a4bccb81bce26fb06441f251353207c7caa91fb78dafc60724283740c61fcef9c7dc5a36cde02a2a3e81a1e0622a0b0d6fddc74
- SSDEEP 98304:emhd1UryeN6jJvzkBjTfVtfBUsV7wQqZUha5jtSyR:elt6jJABjTfVz2QbaZtlR
- MD5 SHA1 SHA512 SSDEEP