Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 12:41
Static task
static1
Behavioral task
behavioral1
Sample
a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
a3c6a8d78de879a521681c2b4fd72bb0
-
SHA1
64d243b34a776eb8abfe12faf0bf1e95d306bfec
-
SHA256
6c2197ffbf7bf44a262b89924e20d9b710f478e22c12d0f6833d064dae381f25
-
SHA512
ff7c4338c1fd4e3c96cb9fe39ab8b3692bfb10ad32ac812010108a0cd6e984f753c7885aa4b1edfa801e95de6b6439f33c1267e6ff313438c6950fc73a1565c0
-
SSDEEP
1536:hbuVCA1HKf02yONi1K5QPqfhVWbdsmA+RjPFLC+e5hg0ZGUGf2g:hqDxqHyONi1NPqfcxA+HFshgOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3128 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1168 wrote to memory of 3148 1168 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 84 PID 1168 wrote to memory of 3148 1168 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 84 PID 1168 wrote to memory of 3148 1168 a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe 84 PID 3148 wrote to memory of 3128 3148 cmd.exe 85 PID 3148 wrote to memory of 3128 3148 cmd.exe 85 PID 3148 wrote to memory of 3128 3148 cmd.exe 85 PID 3128 wrote to memory of 3456 3128 [email protected] 86 PID 3128 wrote to memory of 3456 3128 [email protected] 86 PID 3128 wrote to memory of 3456 3128 [email protected] 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a3c6a8d78de879a521681c2b4fd72bb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exePID:3148
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:3128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:3456
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD574e912367fa279419ed5e0502329f4db
SHA11531b4794a78ba9af74e66c978a6f513f5e6a3e7
SHA2567f144f90c5d8968638c9e3ed2b7790b28ac4dce0400b4b6722bd8f3991ead33b
SHA512d35530d944a9328041ee267e4ebdf9f0443ed02d731107409680fb4a5c9faeb4e3e60cddf6c3e8bc7f68ca673268c7b595c685395e6fa5aa45203fc7cb696613
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1