5d225d4f7953a555f63ad76bc05cb38f7fee7e6b9ea1bbc3c4543a2aa164d9f5

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe
Size 841KB
Sample240603-mz79tsdc95
SHA256 5d225d4f7953a555f63ad76bc05cb38f7fee7e6b9ea1bbc3c4543a2aa164d9f5
MD5 a0dc908d94798fb99e028cf2491dda20
SHA1 7e66e0257fb1a557d4a721a978750b617339d670
SHA512 b34a3e1b346897c713b6cef3bad455c13d2de2906df2359efb60512e8d79244cad62161e762fb40426ea4fd6a7bcbcc477b84469f0771121ee724d86ecda07c0
SSDEEP 24576:7uSMGAeh6XFRbf0ezEM4dmv5BJtOtEM4dmv5zH8HTXm:7MQo7bf0ezj425zUtj425zHwTXm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1928	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1928	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2116	4940	WerFault.exe	81
5108	1928	WerFault.exe	86
2952	1928	WerFault.exe	86
3148	1928	WerFault.exe	86
4232	1928	WerFault.exe	86
1572	1928	WerFault.exe	86
2084	1928	WerFault.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4940	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1928	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1928	4940	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe	86
PID 4940 wrote to memory of 1928	4940	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe	86
PID 4940 wrote to memory of 1928	4940	a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 384
  2⤵
  - Program crash
  PID:2116
- C:\Users\Admin\AppData\Local\Temp\a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 352
    3⤵
    - Program crash
    PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 740
    3⤵
    - Program crash
    PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 808
    3⤵
    - Program crash
    PID:3148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 816
    3⤵
    - Program crash
    PID:4232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 844
    3⤵
    - Program crash
    PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 828
    3⤵
    - Program crash
    PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4940 -ip 4940
1⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1928 -ip 1928
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1928 -ip 1928
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1928 -ip 1928
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1928 -ip 1928
1⤵
PID:588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1928 -ip 1928
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1928 -ip 1928
1⤵
PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\a0dc908d94798fb99e028cf2491dda20_NeikiAnalytics.exe
Size 841KB
SHA256 25d451a194218600a97e51017aade1fd774d150fd713fab2ca20952a75397a00
MD5 0b27485327f4f13df5c36456f366e523
SHA1 f3ef5b9823edfc1c5cb67400f66ec3eaf8cd628f
SHA512 69082c67d8c3b8c1bd6b9c8f7002bc3b15062b3c1a3a09e956a65a680ce10e07288f22c2f70a82046e5208d2a442419112785ea487a5ad7e3772977808fcfc03
SSDEEP 24576:Q1fVoY5h6XFRbf0ezEM4dmv5BJtOtEM4dmv5zH8HTXm:Q1fOYzo7bf0ezj425zUtj425zHwTXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1928-7-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1928-8-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1928-13-0x00000000014F0000-0x0000000001530000-memory.dmp

Download

memory/4940-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4940-5-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads