Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 04:46

General

  • Target

    39471cfa2cd128036698a8a052376620_NeikiAnalytics.exe

  • Size

    255KB

  • MD5

    39471cfa2cd128036698a8a052376620

  • SHA1

    4ccfb14d1991a4bd06612302bc2cfbba4404af13

  • SHA256

    570ccd188f94a1dfe89586e8098b6256e1138b413a3e2c40ee138575c6438d82

  • SHA512

    76ac685fa2acdb9ad23b454926fdfccd0cde35875b7f2280417addebfa98f9a454d64326b0844c79f5bd5f4309e9bb7045ff58738a21899693d531d59dd1989b

  • SSDEEP

    6144:R4qr1wY3IFAg8c54HzIHZhJF27zgVhEQaO/JLtxe/6GfAczg2870V:Hr1l3I78cXZhW8V2QLLqP4kg287o

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39471cfa2cd128036698a8a052376620_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\39471cfa2cd128036698a8a052376620_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\39471cfa2cd128036698a8a052376620_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\39471cfa2cd128036698a8a052376620_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2016

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\39471cfa2cd128036698a8a052376620_NeikiAnalytics.exe

          Filesize

          255KB

          MD5

          ddb9ff63b37ba0f701f6af3e51dab893

          SHA1

          cac62d1bb8bb766e15a1fbb63b8e78dc49d3081d

          SHA256

          fcb4fa1ee35e5046c1ba12a651254d5294101bf060548554bc6c2958a42dec84

          SHA512

          c44330d5ff18ec0b6b5158868c1a433c111dc9875667bfe5af79a7fca8409e7ef6dac0db20b3a05bfb6d796da0c2ef62e6cc98c78158e26e906fbae39ff7d113

        • memory/2016-10-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/2016-11-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2016-16-0x0000000000210000-0x0000000000253000-memory.dmp

          Filesize

          268KB

        • memory/2948-0-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/2948-8-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB