Analysis

  • max time kernel
    144s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 01:08

General

  • Target

    195165c0bab39ed572aed91218ef0e80_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    195165c0bab39ed572aed91218ef0e80

  • SHA1

    98e33beee3f014d06473c4c2405428707a75fda5

  • SHA256

    9952ac86db8effced8afe2276ca70eeb74ef338817b0df5e618a57a81a2fb86e

  • SHA512

    9629090ecf233ad2d4c7f059fe9a600dc6edd40b2700e434fd2c82e0d138c881ba41c52ba9e82f675f0b6a48fe083650678b43e589115defd7de83734125ff79

  • SSDEEP

    1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hy0ZGUGf2g:hGYvHNPqfcxA+HFshyOg

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\195165c0bab39ed572aed91218ef0e80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\195165c0bab39ed572aed91218ef0e80_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      2⤵
        PID:4052
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3148,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
      1⤵
        PID:1016

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\00.exe

              Filesize

              2KB

              MD5

              7b621943a35e7f39cf89f50cc48d7b94

              SHA1

              2858a28cf60f38025fffcd0ba2ecfec8511c197d

              SHA256

              bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

              SHA512

              4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

            • memory/4896-3-0x0000000000400000-0x0000000000419000-memory.dmp

              Filesize

              100KB