Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 13:24

General

  • Target

    a4e237a5a1080b5b99eaa2c44d3bf7e0_NeikiAnalytics.exe

  • Size

    65KB

  • MD5

    a4e237a5a1080b5b99eaa2c44d3bf7e0

  • SHA1

    b488109999ec57f1d49f1c37a2ca51f64d3d5278

  • SHA256

    ca8ba75a4d230be1962d338e1bf8af0450e9f0b4654691f17d3aa95a3ea498fe

  • SHA512

    778c475c16c6f707e8e1f24667463dc7db4d37662fbaf7c89fcb660e8bcd5f901251e5721c20a85d08f4401304465e769a1f3f95addaeab4d53613560cd01838

  • SSDEEP

    768:0eQIvFKPZo2smEasjcj29NWngAHxcw9ppEaxglaX5uAS:09IvEPZo6Ead29NQgA2wQle56

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 14 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4e237a5a1080b5b99eaa2c44d3bf7e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a4e237a5a1080b5b99eaa2c44d3bf7e0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Windows\SysWOW64\ewiuer2.exe
        C:\Windows\System32\ewiuer2.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Users\Admin\AppData\Roaming\ewiuer2.exe
          C:\Users\Admin\AppData\Roaming\ewiuer2.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:324
          • C:\Windows\SysWOW64\ewiuer2.exe
            C:\Windows\System32\ewiuer2.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1928
            • C:\Users\Admin\AppData\Roaming\ewiuer2.exe
              C:\Users\Admin\AppData\Roaming\ewiuer2.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:956
              • C:\Windows\SysWOW64\ewiuer2.exe
                C:\Windows\System32\ewiuer2.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1844
                • C:\Users\Admin\AppData\Roaming\ewiuer2.exe
                  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
                  8⤵
                  • Executes dropped EXE
                  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\77Y2B2QA.txt

    Filesize

    229B

    MD5

    c170b08f9e069b63c55a58c5c31f16f3

    SHA1

    8e17928f7eecb8f7960f3aeca1334fa861aa0a39

    SHA256

    ae49a30fc5010d5857ecf575db8f5903fe23b7616d9e299af627bd2f743f5f48

    SHA512

    f8d38b41d571a9ccfaf0dc1731cf71957f459d9b5ea837d7e9ddc40a25f914b0664db2fee5cd8990ba8c7b203124314bc06cce95478ae5d274c097444deb60a4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\J47M0J7Y.txt

    Filesize

    230B

    MD5

    57c0ace28eabe941ed06cb8a7c0ff76f

    SHA1

    dc8f5769f57f4cbf5140b0254f8c6194f157780b

    SHA256

    25094d1ef522cea52f3b84301cbf45aa79d9ed6c4680cd3a527202b9784725a8

    SHA512

    dc2a48e8573abc3fd59833349e4209381b84c626c742f33efaef5825e04e025e773931b203949ae326d5f41fa91242943afab8e5b8f8311af491dc9b53c04ba1

  • C:\Users\Admin\AppData\Roaming\ewiuer2.exe

    Filesize

    65KB

    MD5

    6e416b440ecec8ed685fb589da3b02b0

    SHA1

    1fbc94cf2485e4e2f9c9e9e54cf4ee88e11281a5

    SHA256

    7dce6d4d13c02f43483d382ee0e4ba44ecb2512808b010b03e81424cc09604df

    SHA512

    3f8f38184f3de425f46457f6b82ccd07051d0d80de8caefd4efcf03666e703311c259982b8b493050209c96591edb2393d247686d85bead6c0cb6b3ac3a2f72b

  • \Users\Admin\AppData\Roaming\ewiuer2.exe

    Filesize

    65KB

    MD5

    22baa22fb2dc1600939b793612adc98c

    SHA1

    dba20e5aa89b40040cc299577a0670b9065083d1

    SHA256

    563c9cbb976ecf818ddd0846b54e227cc0cc1ff90f498d4f97c0ab8f2ce478e6

    SHA512

    deedf690e03d7044a8c6a1a9420cc4f7213ab37497a078cd1a981855d6fae3142e5d58c5aa82df9ccf32de77848f0fb9d39ad3ed1818f2ec0a1bd4867757fc1f

  • \Users\Admin\AppData\Roaming\ewiuer2.exe

    Filesize

    65KB

    MD5

    8e0a227d63cd8bca66fa17eaa43c1e52

    SHA1

    59d30606ff8964c90b939ce65b035ecff653ce28

    SHA256

    443adf970bee30d334167a1fe3bd961db97b289d83f15dfaecd3d12f67de5d6e

    SHA512

    bf0f1b5f7aebd5f0335a16012b4c5f547af2d3043651a4f0e7dd5bc735a6b462f1b6e9f12b24dd8d4520c144453b13d1bc25b98c1bd399a9151315ee5ee841b5

  • \Users\Admin\AppData\Roaming\ewiuer2.exe

    Filesize

    65KB

    MD5

    ab48b6ea5a64d9ad2ab90660a83c8638

    SHA1

    98b8292517ee1a9bdfdf28f9a4856c61cab38b65

    SHA256

    d3602fc894e656847a6e8ed77ada37e99cab733dc7b622a1c33349c5e06c9a0a

    SHA512

    b10d0ddbfa5c066a882ffbcc0c470b8cfae1145fc1c82e1190ba57d57521dd36ff6d23840073082501d78d33d82f23d0dff892174ed89327130dacf06eb5e842

  • \Windows\SysWOW64\ewiuer2.exe

    Filesize

    65KB

    MD5

    c133b07e8c5a6862e141bdc3c2a0492e

    SHA1

    1a380b2efcd872b15e71485ba1c231db8357585f

    SHA256

    b53f7b30e6684ec44a11e7f858fdb241533476dcedec057d10d685a45bbc5fc5

    SHA512

    a79eef221d4dbbd72d2567e42e7be907a3ae8f5449a922373a453102bc0f49315e271e7b16595bcc5ba97190501d4f2597ba5e9abfa8879706c07e1daa51e167

  • \Windows\SysWOW64\ewiuer2.exe

    Filesize

    65KB

    MD5

    24e80da598e4389efa99017feadb5bf6

    SHA1

    12e8caacaf2c32f5b21a8c75b9fe21c8aa948a58

    SHA256

    db49ce11843b456856afe16700cf21d4610cd29e2e77c9a7b71b8cbef62f69ed

    SHA512

    f42652300ec3dc3b9f8164fa3a75e935c4dc6bb375309f94afd5612949cca4604bcdb7eed63c1c9dbb6ef30736e089c117b7973b291e69580c5633446de01c6c

  • \Windows\SysWOW64\ewiuer2.exe

    Filesize

    65KB

    MD5

    0b15ac961754306b89304090864ada55

    SHA1

    d365851b43c08542d77a81c7bb4ff47c5a5a2645

    SHA256

    2fdff959b0370bce182795ffd258ef293b3d7fc91de44a2ce31cb3fcf29332be

    SHA512

    e6fc40489d51a432c5de441ed4c6fa1379d89d745dac3ae7b261f43331b3f5ed6afaba7a42cad06de54c8a28740318455c0a2f287dcb5a850e1a8b1a9b6050cf

  • memory/324-48-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/324-43-0x0000000002230000-0x000000000225A000-memory.dmp

    Filesize

    168KB

  • memory/324-37-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/956-60-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/956-67-0x0000000002690000-0x00000000026BA000-memory.dmp

    Filesize

    168KB

  • memory/956-74-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/956-62-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1844-84-0x0000000000220000-0x000000000024A000-memory.dmp

    Filesize

    168KB

  • memory/1844-83-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1928-58-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2084-17-0x00000000004B0000-0x00000000004DA000-memory.dmp

    Filesize

    168KB

  • memory/2084-11-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2084-12-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2084-24-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2776-30-0x00000000001B0000-0x00000000001DA000-memory.dmp

    Filesize

    168KB

  • memory/2776-29-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2812-1-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2812-8-0x00000000001B0000-0x00000000001DA000-memory.dmp

    Filesize

    168KB