Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe
-
Size
73KB
-
MD5
a47ea76f7ab49c8376179996d2a86e80
-
SHA1
df6caae43e5380a9dfd3a2b4b36f20887e9821c1
-
SHA256
7dc7c9fa8c276971bf2a99592d901a4e5512606c884f994c142be770789cae2f
-
SHA512
4d390115db9f93994426ba224a1cce0229a22e00e7bc5374f74941a05fd2f91d4e88ac253b97c5ca335c004b1fb698442646cf0e4f03bd9ea7616319559c429b
-
SSDEEP
1536:hbyBf/SXqK5QPqfhVWbdsmA+RjPFLC+e5hy0ZGUGf2g:h7XqNPqfcxA+HFshyOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3028 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 3004 cmd.exe 3004 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3004 2716 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 29 PID 2716 wrote to memory of 3004 2716 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 29 PID 2716 wrote to memory of 3004 2716 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 29 PID 2716 wrote to memory of 3004 2716 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 29 PID 3004 wrote to memory of 3028 3004 cmd.exe 30 PID 3004 wrote to memory of 3028 3004 cmd.exe 30 PID 3004 wrote to memory of 3028 3004 cmd.exe 30 PID 3004 wrote to memory of 3028 3004 cmd.exe 30 PID 3028 wrote to memory of 1056 3028 [email protected] 31 PID 3028 wrote to memory of 1056 3028 [email protected] 31 PID 3028 wrote to memory of 1056 3028 [email protected] 31 PID 3028 wrote to memory of 1056 3028 [email protected] 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:3028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:1056
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5a496c05272dfdc6b37d7920511d1be36
SHA13c17e1eea4472555e638c702f6236ce092cb1315
SHA256c83addff31669655bd3dfddd076d8e8bed4659d9c4b2965dbe7664b19b4e3df0
SHA51277823a3077af99e03e5e3b2f6fc77b9964832c4992a9b348d3390c2bbe5306493c10eb40540c999897f71660776b59d00122c038f3758b36ba3233ac1410e49b