Analysis
-
max time kernel
133s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe
-
Size
40KB
-
MD5
976fec1f7068de234d4b152c88403730
-
SHA1
bb6f8efa8fb035baf680e8d99b8c38277a40677a
-
SHA256
aaa82c7252c2b993eb68297f50bd58e00d0292361248fc788b74f891d4fcfcc4
-
SHA512
d2a2996c7b05ab5b4a4d3dfe2039eccb8d6b214aac4af236712dae2578d92797560424c2bdd7efde4e1e2cf908cca807f84d7a6924b500acd5f52e8e0646b3fc
-
SSDEEP
384:R4xUgL9mP/khB8Dy4MfyzLeReRGngzXZ+Yu1zJIFBdy1AQrPgwNt6AMJ1cbfnVz6:eGknMFiiDMNzJIFBLQ7XNt6bk6
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 1644 regedit.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 3296 976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe 3296 976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3296 wrote to memory of 1644 3296 976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe 83 PID 3296 wrote to memory of 1644 3296 976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe 83 PID 3296 wrote to memory of 1644 3296 976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\976fec1f7068de234d4b152c88403730_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:1644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166B
MD5f44153ef26be29552cf320325ad8b72e
SHA174ac72ba2ff0f871e59b11c95ad707372662370c
SHA256767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
SHA5121d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
-
Filesize
40KB
MD53c7ee4edd1219a1c0c76fad595916e57
SHA14e0d125d4e3dc3396f6303602e891682ce6b5a70
SHA256e6d423229740e757e853c754eee7d9542e6318bb08a4e8488d1495364dc550f9
SHA5125c37f83b8d180012f3e4353c9947c04d9f3b9ad00795b9449442de61e5bd80de62cbb390db14ed8432dadd5e0e0963a65d56c467514da460890eeaf3132a6bf3