Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 04:17
Static task
static1
Behavioral task
behavioral1
Sample
9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe
-
Size
225KB
-
MD5
9b46256f28d4672b60b68cf5284ec690
-
SHA1
da4654ed7f7d7e6ce3a91b7a73e20ac879c70d34
-
SHA256
ee08501afc61510a6d102611ae2516987b2b4ce4bf18ae4a8e3aee1bbc5d5647
-
SHA512
1158f0d16ead8fb831819006f3bf70a9ed82453c4f9383199f6d21238ec2336b3d7f74a3257ac13bb559c84619bf0ded31503925bcac623c65d9c5aaeb75b7e0
-
SSDEEP
6144:5A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:5ATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\9ED35FF8 = "C:\\Users\\Admin\\AppData\\Roaming\\9ED35FF8\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
winver.exepid process 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe 2636 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 2636 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exewinver.exedescription pid process target process PID 956 wrote to memory of 2636 956 9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe winver.exe PID 956 wrote to memory of 2636 956 9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe winver.exe PID 956 wrote to memory of 2636 956 9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe winver.exe PID 956 wrote to memory of 2636 956 9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe winver.exe PID 956 wrote to memory of 2636 956 9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe winver.exe PID 2636 wrote to memory of 1188 2636 winver.exe Explorer.EXE PID 2636 wrote to memory of 1112 2636 winver.exe taskhost.exe PID 2636 wrote to memory of 1164 2636 winver.exe Dwm.exe PID 2636 wrote to memory of 1188 2636 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9b46256f28d4672b60b68cf5284ec690_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/956-8-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1112-21-0x00000000003A0000-0x00000000003A6000-memory.dmpFilesize
24KB
-
memory/1112-11-0x00000000003A0000-0x00000000003A6000-memory.dmpFilesize
24KB
-
memory/1164-23-0x00000000001B0000-0x00000000001B6000-memory.dmpFilesize
24KB
-
memory/1164-14-0x00000000001B0000-0x00000000001B6000-memory.dmpFilesize
24KB
-
memory/1188-1-0x0000000002D20000-0x0000000002D26000-memory.dmpFilesize
24KB
-
memory/1188-17-0x0000000002D70000-0x0000000002D76000-memory.dmpFilesize
24KB
-
memory/1188-3-0x0000000002D20000-0x0000000002D26000-memory.dmpFilesize
24KB
-
memory/1188-6-0x0000000002D20000-0x0000000002D26000-memory.dmpFilesize
24KB
-
memory/1188-22-0x0000000002D70000-0x0000000002D76000-memory.dmpFilesize
24KB
-
memory/2636-20-0x00000000001B0000-0x00000000001B6000-memory.dmpFilesize
24KB
-
memory/2636-4-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB
-
memory/2636-25-0x00000000001B0000-0x00000000001B6000-memory.dmpFilesize
24KB