Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 13:07
Static task
static1
Behavioral task
behavioral1
Sample
a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe
-
Size
73KB
-
MD5
a46ae228af8238162084801f03b0e100
-
SHA1
78121075c3b26669bb2a4b2587f74650054cb90f
-
SHA256
d74df87f2e60774c97fbbbcab14dcdc8d61211713df37774b181d38577c192db
-
SHA512
5c6b302392ff4eb293003e451a3e05b3844726954b4e467c990c834ef410fa2c220422ba2a3760d997d1cdf8d98e53f39eba4d89053c92a40f5c7d24fdea18b5
-
SSDEEP
1536:hbokyO8MUh6K5QPqfhVWbdsmA+RjPFLC+e5ht0ZGUGf2g:hcrO7Uh6NPqfcxA+HFshtOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2688 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3932 wrote to memory of 792 3932 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 92 PID 3932 wrote to memory of 792 3932 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 92 PID 3932 wrote to memory of 792 3932 a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe 92 PID 792 wrote to memory of 2688 792 cmd.exe 93 PID 792 wrote to memory of 2688 792 cmd.exe 93 PID 792 wrote to memory of 2688 792 cmd.exe 93 PID 2688 wrote to memory of 1204 2688 [email protected] 94 PID 2688 wrote to memory of 1204 2688 [email protected] 94 PID 2688 wrote to memory of 1204 2688 [email protected] 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a46ae228af8238162084801f03b0e100_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exePID:792
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 15225.exe4⤵PID:1204
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:2964
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD59b4e1d6de11dd4672b0723a9bb3ef9b6
SHA14e628da29bb213a60f106de5bebbd0e9f3c26b32
SHA256eaa48aa237febe36f8f0bb998a6f61ca4b79660176ebbdb33d3b815df062756d
SHA512428ca9f3c4839cffb29b65abeb71e257bc4d2c5f4fe7d8e22e167393c0da2938b7f75a5ba0dbccc522eb218f9c33f6a8b3c2bbee1981825e5863cfc7e9ac04d4
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1