Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe
-
Size
73KB
-
MD5
a46ae228af8238162084801f03b0e100
-
SHA1
78121075c3b26669bb2a4b2587f74650054cb90f
-
SHA256
d74df87f2e60774c97fbbbcab14dcdc8d61211713df37774b181d38577c192db
-
SHA512
5c6b302392ff4eb293003e451a3e05b3844726954b4e467c990c834ef410fa2c220422ba2a3760d997d1cdf8d98e53f39eba4d89053c92a40f5c7d24fdea18b5
-
SSDEEP
1536:hbokyO8MUh6K5QPqfhVWbdsmA+RjPFLC+e5ht0ZGUGf2g:hcrO7Uh6NPqfcxA+HFshtOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2344 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2524 cmd.exe 2524 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2524 2196 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2524 2196 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2524 2196 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2524 2196 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 29 PID 2524 wrote to memory of 2344 2524 cmd.exe 30 PID 2524 wrote to memory of 2344 2524 cmd.exe 30 PID 2524 wrote to memory of 2344 2524 cmd.exe 30 PID 2524 wrote to memory of 2344 2524 cmd.exe 30 PID 2344 wrote to memory of 2532 2344 [email protected] 31 PID 2344 wrote to memory of 2532 2344 [email protected] 31 PID 2344 wrote to memory of 2532 2344 [email protected] 31 PID 2344 wrote to memory of 2532 2344 [email protected] 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 15225.exe4⤵PID:2532
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD59b4e1d6de11dd4672b0723a9bb3ef9b6
SHA14e628da29bb213a60f106de5bebbd0e9f3c26b32
SHA256eaa48aa237febe36f8f0bb998a6f61ca4b79660176ebbdb33d3b815df062756d
SHA512428ca9f3c4839cffb29b65abeb71e257bc4d2c5f4fe7d8e22e167393c0da2938b7f75a5ba0dbccc522eb218f9c33f6a8b3c2bbee1981825e5863cfc7e9ac04d4