Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
a46a5e1dc3ee850f594398b729898dd0
-
SHA1
0fa0376fc2708873eb5d030f88febdd05338ace5
-
SHA256
ce766d4455dc1508aa4b42557c6df124983a889bad224febab086de312271080
-
SHA512
ecb5181eaf3544619321319549f118eff6136310f721a9217480008199fa7fc58a499b9cbc0ed0c66f6ef952a83f594e74768506c974228918d6220630cabefe
-
SSDEEP
1536:zvm5Om0rld8Ms1FAOgSmOQA8AkqUhMb2nuy5wgIP0CSJ+5yIB8GMGlZ5G:zvm5OTld8r1QSjGdqU7uy5w9WMyIN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2740 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2592 cmd.exe 2592 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2592 2264 a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe 29 PID 2264 wrote to memory of 2592 2264 a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe 29 PID 2264 wrote to memory of 2592 2264 a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe 29 PID 2264 wrote to memory of 2592 2264 a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe 29 PID 2592 wrote to memory of 2740 2592 cmd.exe 30 PID 2592 wrote to memory of 2740 2592 cmd.exe 30 PID 2592 wrote to memory of 2740 2592 cmd.exe 30 PID 2592 wrote to memory of 2740 2592 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2740
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5a5800c4a188287b9665234e553a89099
SHA119f34c19d71dec2dbb9be299e78f37ef962f7ca4
SHA256e9b8e49b4a686ae5b6ecf8372d14fe13358ca420119c8be553b1b173a321c84e
SHA5120e8108a3869b3b2a1c3af5195bdbaf66a1c0782e58afede8e52a0a57b78ff286b701bd9c9bcbbb81a00f15b8ee156556056a873cdd25b35d27a372975176c636