Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe
-
Size
73KB
-
MD5
a47ea76f7ab49c8376179996d2a86e80
-
SHA1
df6caae43e5380a9dfd3a2b4b36f20887e9821c1
-
SHA256
7dc7c9fa8c276971bf2a99592d901a4e5512606c884f994c142be770789cae2f
-
SHA512
4d390115db9f93994426ba224a1cce0229a22e00e7bc5374f74941a05fd2f91d4e88ac253b97c5ca335c004b1fb698442646cf0e4f03bd9ea7616319559c429b
-
SSDEEP
1536:hbyBf/SXqK5QPqfhVWbdsmA+RjPFLC+e5hy0ZGUGf2g:h7XqNPqfcxA+HFshyOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4332 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1808 wrote to memory of 4996 1808 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 84 PID 1808 wrote to memory of 4996 1808 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 84 PID 1808 wrote to memory of 4996 1808 a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe 84 PID 4996 wrote to memory of 4332 4996 cmd.exe 85 PID 4996 wrote to memory of 4332 4996 cmd.exe 85 PID 4996 wrote to memory of 4332 4996 cmd.exe 85 PID 4332 wrote to memory of 3220 4332 [email protected] 86 PID 4332 wrote to memory of 3220 4332 [email protected] 86 PID 4332 wrote to memory of 3220 4332 [email protected] 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a47ea76f7ab49c8376179996d2a86e80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exePID:4996
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:4332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:3220
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5a496c05272dfdc6b37d7920511d1be36
SHA13c17e1eea4472555e638c702f6236ce092cb1315
SHA256c83addff31669655bd3dfddd076d8e8bed4659d9c4b2965dbe7664b19b4e3df0
SHA51277823a3077af99e03e5e3b2f6fc77b9964832c4992a9b348d3390c2bbe5306493c10eb40540c999897f71660776b59d00122c038f3758b36ba3233ac1410e49b
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1