Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 12:41
Static task
static1
Behavioral task
behavioral1
Sample
a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
a3c6a8d78de879a521681c2b4fd72bb0
-
SHA1
64d243b34a776eb8abfe12faf0bf1e95d306bfec
-
SHA256
6c2197ffbf7bf44a262b89924e20d9b710f478e22c12d0f6833d064dae381f25
-
SHA512
ff7c4338c1fd4e3c96cb9fe39ab8b3692bfb10ad32ac812010108a0cd6e984f753c7885aa4b1edfa801e95de6b6439f33c1267e6ff313438c6950fc73a1565c0
-
SSDEEP
1536:hbuVCA1HKf02yONi1K5QPqfhVWbdsmA+RjPFLC+e5hg0ZGUGf2g:hqDxqHyONi1NPqfcxA+HFshgOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2916 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2968 cmd.exe 2968 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2968 1028 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 29 PID 1028 wrote to memory of 2968 1028 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 29 PID 1028 wrote to memory of 2968 1028 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 29 PID 1028 wrote to memory of 2968 1028 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 29 PID 2968 wrote to memory of 2916 2968 cmd.exe 30 PID 2968 wrote to memory of 2916 2968 cmd.exe 30 PID 2968 wrote to memory of 2916 2968 cmd.exe 30 PID 2968 wrote to memory of 2916 2968 cmd.exe 30 PID 2916 wrote to memory of 2560 2916 [email protected] 31 PID 2916 wrote to memory of 2560 2916 [email protected] 31 PID 2916 wrote to memory of 2560 2916 [email protected] 31 PID 2916 wrote to memory of 2560 2916 [email protected] 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:2560
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD574e912367fa279419ed5e0502329f4db
SHA11531b4794a78ba9af74e66c978a6f513f5e6a3e7
SHA2567f144f90c5d8968638c9e3ed2b7790b28ac4dce0400b4b6722bd8f3991ead33b
SHA512d35530d944a9328041ee267e4ebdf9f0443ed02d731107409680fb4a5c9faeb4e3e60cddf6c3e8bc7f68ca673268c7b595c685395e6fa5aa45203fc7cb696613