Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe
-
Size
79KB
-
MD5
a03abacff4ae7e2606bbb76642771500
-
SHA1
bcecd596f1e58c5f684ac24bac327c045ca21eab
-
SHA256
73dec9c2a4420c82e511e194ae190c68ae7bcddd59ae9335db9059f5daf4484e
-
SHA512
b81d2427555608a9d88c9000c0dd6a215c88f05f7d3d98737ba2fb3735a349c149d30b6615b0f81de525aecfc867e799a0d9cc4e0225508f907308d0aed15a74
-
SSDEEP
1536:zvUaySa+bHSOR6POQA8AkqUhMb2nuy5wgIP0CSJ+5yAB8GMGlZ5G:zv6wHn6mGdqU7uy5w9WMyAN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2896 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 1252 cmd.exe 1252 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1252 1964 a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe 29 PID 1964 wrote to memory of 1252 1964 a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe 29 PID 1964 wrote to memory of 1252 1964 a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe 29 PID 1964 wrote to memory of 1252 1964 a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe 29 PID 1252 wrote to memory of 2896 1252 cmd.exe 30 PID 1252 wrote to memory of 2896 1252 cmd.exe 30 PID 1252 wrote to memory of 2896 1252 cmd.exe 30 PID 1252 wrote to memory of 2896 1252 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a03abacff4ae7e2606bbb76642771500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2896
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD567ed717d60d2ee007271fce28918dc6c
SHA18d5d33672d7cbf1d1618f3d31a7f2fbc45d8fa6c
SHA256c29886bcba330ba93184d12ed2728353ec8e9aa3057414931481d5b7cd101fa4
SHA512d6741c9f3efe277c08676ecff66416d0f25599caac09c67ee330e85d0f10c68a4cd1e724563667748b251c89938895b2b168eb2b9ce3f0ff19d7db8655489c02