Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:43
Behavioral task
behavioral1
Sample
a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe
- Size 5.8MB
- Sample240603-q1ntcsgd41
- SHA256 1cfe25c8e7aaa4aafe72115c7a5ee8a55506633e749d2feaa9aeb13c2a94f13e
- MD5 a55b23fc64e523f3328294fd9685e9d0
- SHA1 0f4eb256080bdf43a18cff35a9817ea27a0f6682
- SHA512 f053559804d007929c2673d6d34e19ab01f6f8c0d5fac8f2f374a880c8a76891fa23b886bf9a70459036b0263029596dfb5760153d76f7e2fc57e6fbce1c5ba0
- SSDEEP 98304:1I1GsCs1NBEZ1NFt2889bxoJW/xclWSV7SxyqxrQ:MGdV/2tbuWpeaQ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4744-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0001000000022aaa-5.dat upx behavioral2/memory/4744-1777-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\desktop.ini a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\desktop.ini a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\io.txt a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msado27.tlb a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\mng2.txt a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipstr.xml a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\an.txt a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\ky.txt a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\tabskb.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msado28.tlb a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\System\Ole DB\msdatl3.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File created \??\c:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5800 4744 WerFault.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a55b23fc64e523f3328294fd9685e9d0_NeikiAnalytics.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 4762⤵
- Program crash
PID:5800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4744 -ip 47441⤵PID:2928
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 7.5MB
- SHA256 081658a5b6309687abc41cac506ca6ad04bef6132213d96bf6af75a03efbade7
- MD5 7f9ba67b1caeede159bdf3c9a906fecb
- SHA1 35026e910632e1867c4292d1c4c008dbe20b9336
- SHA512 3675a9526745ec03ee87c611f8c94f201e985eb6f92181ff66a002dcc0dc111595e0ea7f5d0191b601853dfd8d55fc835ee845b8f9c79174319ffab229a22a6b
- SSDEEP 98304:1I1GsCs1NBEZ1NFt2889bxoJW/xclWSV7SxyqxrF8Y/QSirHv2R:MGdV/2tbuWpea+2irH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512