3591fc744bc8ed884ade45618d80be87c57dacc0641c524ea9354eb5979c99b8

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00a135c6959820b818c75c29d048d2c0_NeikiAnalytics.exe
Size 12KB
Sample240603-tp63caca6w
SHA256 3591fc744bc8ed884ade45618d80be87c57dacc0641c524ea9354eb5979c99b8
MD5 00a135c6959820b818c75c29d048d2c0
SHA1 dce493a7025b255f4de6c506349384097dfd1bff
SHA512 260cd3286f18f5de0567ceaebd4921bdc420a32f91cccc5e5b2b0cf9d3fe026414a117bb4166d514b796c2c78c45fd4ffc4e17d622fa0ccbb53f6a51d9d8471e
SSDEEP 192:IYDT5qTiuL8i6D6S0ETAwoVaPGo0J6U7RiN/820CEPWlJdxqHeG:FH9dS57yZ2WlJj+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1348	240603161506448.exe
2492	242603161512963.exe
3828	242603161526807.exe
1688	242603161537026.exe
5068	242603161549104.exe
4648	242603161601104.exe
4624	242603161611166.exe
2940	242603161626260.exe
1952	242603161636713.exe
1920	242603161659479.exe
2256	242603161709713.exe
4572	242603161720088.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4724	444	00a135c6959820b818c75c29d048d2c0_NeikiAnalytics.exe	92
PID 444 wrote to memory of 4724	444	00a135c6959820b818c75c29d048d2c0_NeikiAnalytics.exe	92
PID 4724 wrote to memory of 1348	4724	cmd.exe	93
PID 4724 wrote to memory of 1348	4724	cmd.exe	93
PID 1348 wrote to memory of 4664	1348	240603161506448.exe	97
PID 1348 wrote to memory of 4664	1348	240603161506448.exe	97
PID 4664 wrote to memory of 2492	4664	cmd.exe	98
PID 4664 wrote to memory of 2492	4664	cmd.exe	98
PID 2492 wrote to memory of 4196	2492	242603161512963.exe	100
PID 2492 wrote to memory of 4196	2492	242603161512963.exe	100
PID 4196 wrote to memory of 3828	4196	cmd.exe	101
PID 4196 wrote to memory of 3828	4196	cmd.exe	101
PID 3828 wrote to memory of 552	3828	242603161526807.exe	103
PID 3828 wrote to memory of 552	3828	242603161526807.exe	103
PID 552 wrote to memory of 1688	552	cmd.exe	104
PID 552 wrote to memory of 1688	552	cmd.exe	104
PID 1688 wrote to memory of 3820	1688	242603161537026.exe	105
PID 1688 wrote to memory of 3820	1688	242603161537026.exe	105
PID 3820 wrote to memory of 5068	3820	cmd.exe	106
PID 3820 wrote to memory of 5068	3820	cmd.exe	106
PID 5068 wrote to memory of 972	5068	242603161549104.exe	107
PID 5068 wrote to memory of 972	5068	242603161549104.exe	107
PID 972 wrote to memory of 4648	972	cmd.exe	108
PID 972 wrote to memory of 4648	972	cmd.exe	108
PID 4648 wrote to memory of 3464	4648	242603161601104.exe	110
PID 4648 wrote to memory of 3464	4648	242603161601104.exe	110
PID 3464 wrote to memory of 4624	3464	cmd.exe	111
PID 3464 wrote to memory of 4624	3464	cmd.exe	111
PID 4624 wrote to memory of 2836	4624	242603161611166.exe	112
PID 4624 wrote to memory of 2836	4624	242603161611166.exe	112
PID 2836 wrote to memory of 2940	2836	cmd.exe	113
PID 2836 wrote to memory of 2940	2836	cmd.exe	113
PID 2940 wrote to memory of 1424	2940	242603161626260.exe	120
PID 2940 wrote to memory of 1424	2940	242603161626260.exe	120
PID 1424 wrote to memory of 1952	1424	cmd.exe	121
PID 1424 wrote to memory of 1952	1424	cmd.exe	121
PID 1952 wrote to memory of 1804	1952	242603161636713.exe	122
PID 1952 wrote to memory of 1804	1952	242603161636713.exe	122
PID 1804 wrote to memory of 1920	1804	cmd.exe	123
PID 1804 wrote to memory of 1920	1804	cmd.exe	123
PID 1920 wrote to memory of 3612	1920	242603161659479.exe	124
PID 1920 wrote to memory of 3612	1920	242603161659479.exe	124
PID 3612 wrote to memory of 2256	3612	cmd.exe	125
PID 3612 wrote to memory of 2256	3612	cmd.exe	125
PID 2256 wrote to memory of 2816	2256	242603161709713.exe	128
PID 2256 wrote to memory of 2816	2256	242603161709713.exe	128
PID 2816 wrote to memory of 4572	2816	cmd.exe	129
PID 2816 wrote to memory of 4572	2816	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\00a135c6959820b818c75c29d048d2c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00a135c6959820b818c75c29d048d2c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240603161506448.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Users\Admin\AppData\Local\Temp\240603161506448.exe
    C:\Users\Admin\AppData\Local\Temp\240603161506448.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161512963.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\242603161512963.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161512963.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161526807.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\242603161526807.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161526807.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161537026.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\242603161537026.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161537026.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161549104.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\242603161549104.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161549104.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161601104.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\242603161601104.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161601104.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161611166.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\242603161611166.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161611166.exe 000007
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161626260.exe 000008
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\242603161626260.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161626260.exe 000008
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161636713.exe 000009
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\242603161636713.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161636713.exe 000009
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161659479.exe 00000a
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\242603161659479.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161659479.exe 00000a
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161709713.exe 00000b
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\242603161709713.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161709713.exe 00000b
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242603161720088.exe 00000c
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\242603161720088.exe
        
        C:\Users\Admin\AppData\Local\Temp\242603161720088.exe 00000c
        25⤵
        Executes dropped EXE
        
        PID:4572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240603161506448.exe

Path C:\Users\Admin\AppData\Local\Temp\240603161506448.exe
Size 13KB
SHA256 601826cefcf99ce8e894685b946dc8e300f8c057b95e7552ac37d641a2e61042
MD5 9705e6ca1f9c2325038bcc73ee13101d
SHA1 47b661e0dbadf3e4a77d01b6a1b8ce7e15d73f00
SHA512 421146df5170967ad5e52dc082ee298f06c043a3bac65bf94d20b89553326ff04cf437f4fc17344af70b9224845488895f6fd18d3e682cc9d52fa703097c6d60
SSDEEP 192:ottzI16zzI6iyWv6OyVSAnzmNw3uayRPSrys1y0cj3HkYK6gGCxWDl+DlWWlJdxJ:IJzViFHlw8NCvXxWh+hWWlJj+Bw
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161512963.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161512963.exe
Size 12KB
SHA256 bdc1997e8da0443f25e4cf3343fc19b1874770b2771befacd9b6dc9aaef8f3af
MD5 bdb2b3b0cbf657d8c7dc1c17daf6beb0
SHA1 8f3162899270c0b648dfb49f841cc55b202f5346
SHA512 d3b0bc4bdf0316cac1f6b367586e0e8ca725c72bc14f0247538816e58f9d7308b8dee8e9c1ed33b0d6386755e95034a508eb03af30985dfca4cfa296414fce7c
SSDEEP 192:3mSI1cOVHTAAN684TOh3egBB8zGCakwP+mR2bQ0lq29GVJDDD3WlJdxqHkHW1x:tsVHkAzeakRlspbDDD3WlJj+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161526807.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161526807.exe
Size 12KB
SHA256 9daae5441f2679dbf1f96a2d9fb5f5e4c30765276b71d9d30effba289b46e91c
MD5 ecaf5061beb72a35267bbe6d368325cc
SHA1 fe6931b4cc10ed3156900209a1c00a4564bd13c3
SHA512 378e79b3c087dbd457aa928cc3a4b05733de7e8e7488bd4d06992b683a03132951f67b5e4d50acbb2936df4f12c7290be8583565cedf9544b9205535d97ca725
SSDEEP 192:2k8zI1lJZdWNzUF6vZCPYods2nDfF0oTPg6KYEizjK4t7mR5RWlJdxqHiYr1J1x:6YPdKwc+jISfwhWlJj+V
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161537026.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161537026.exe
Size 12KB
SHA256 8dbdccaf8a778b9519ee6457ca0be2068faf0194f988cb531383ccd3b25c0499
MD5 e2e26c4a9aabcb22fb0b0159f63d94f2
SHA1 66a374aba6316dd563a8c76f7e88419bd1e82375
SHA512 a8594b999f60ac4cbca41226d98323cad49faee7ede9ddaf8453b4823e5f6a6953dd98fa67b96313633cdc7f731f654e51daa032e2c4aca890c6b269c3165338
SSDEEP 192:9GaI1/Hr6txaXt60qvXvftpBCz4zKuhCPs88mRbPMUW9LGqWH/WlJdxqHgrrq1x:/U6twXH2jjN5AHWAVWlJj+5
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161549104.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161549104.exe
Size 12KB
SHA256 e151c82306e29473c7468fae867de1eb23902d61757fe5d904e4124b07741766
MD5 fd285139bf63d18d821e382aa4ceb97b
SHA1 922eebfc186a7209ac0b9d53ef30fb12bd85c757
SHA512 de05df72df6742ebbc9144f16081677020cbbecbd78bdcc169cb3e80a4a6bf8a77f328e6092f853fcf3c520bc1b27555898ddd4d11edb1640056af568184ac97
SSDEEP 192:olYI1sv86+JN6e8O/Rig6sS2MuYYuwP4c9po7wGVSpSiWlJdxqHgrfO1x:tz06atkFquGQx8IiWlJj+5
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161601104.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161601104.exe
Size 13KB
SHA256 9be8897dd14dc980f9514963a40ef3e05bd11418907aa86fce8136dd85ca0440
MD5 ec108d751f8cf3ee8d8cbfe88afef249
SHA1 4502e4478d1d5d0d8aa9ef75d8a063c86b61c600
SHA512 36279221cb58f1e701c5b3b9c874dfff9ab23e727ca74cf5036c86b7b0575ef71de5101789b0e8c62ef530854aa4fe86d07a95d279f79293024f626fcb6cd94e
SSDEEP 192:jB77I1fQvRgFRO6D79C8SZ++Xo4DeGysPsgkZrcBfSWXYNIs5yotWlJdxqHXYrK/:dLv6FRBXnTuy60WwrQwWlJj+3x
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161611166.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161611166.exe
Size 12KB
SHA256 b6594c56ac400a5a90523143ff634ef76aba153ff3ed4a07c95551f68d29bef7
MD5 8f52a8d1f828e324d4dd17c6953ff1d0
SHA1 b8a9351d252c8a187c7795e9a6c0b8c50e686163
SHA512 ee18e87616816446d77b7157528a1cb9d26eae17ea4472e2087d8a02763fd7ef7421408ada9ca0f9963368299b26e5817db05574846797efcb188195c3d1d872
SSDEEP 192:ldIbI1M1NskOZ5mq6OsW/aiQpSnAfedfKYPQ8PdJA/Ym0WlJdxqHbrZP1x:M7ck+5FAsKv50WlJj+H
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161626260.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161626260.exe
Size 12KB
SHA256 dbc394d1394c0963daa34bc44bb0baef7de53229cd96c446bfbbfaf56a3baa24
MD5 3ecce3a40a9e9729cdca650e36f4d571
SHA1 5c3e41980838ddd38a7a009505653019d8d7cfda
SHA512 561085d4c6ad55101a041c7ef86863dbb3288789328a73a815aef54f113e9d3215121a8eb437da4a0a7ffab87380b7fa60f854c07714be89da34ffc241e44beb
SSDEEP 192:N58V+I1yn8k6BEF6s5Mi1KVtwxjgMOO6ksoPC5ePWKtW4ts5m7WlJdxqHst1xdA:Xdok6WB8fkseFrtx7WlJj+c0
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161636713.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161636713.exe
Size 12KB
SHA256 821c74303e491ec5e0934444c2df40342880f09f4d7579bbf024a0c1426016e2
MD5 ff16c88fda7458fbc0050c6a40ca5612
SHA1 46d3a9f43aaaf4bbb9bd64cf7637aa61c4076bb6
SHA512 5021be42ee39f09d5da15c086597e5d532104250d7a1bb180fefe60767f2813aa959d8cca02a0704845e3ad2be2c2d352f58100b2dd763ddf99935fd08ad8669
SSDEEP 192:QtoI1SMau/l6uMAtpw5wZyYkhQ+IPg1NPgNmZJDHDrWlJdxqHv/1x:dIaY/QJUA/DHDrWlJj+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161659479.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161659479.exe
Size 13KB
SHA256 c51ce27136a6b5b737795e069c36cc851fb6e3f1a833dde6b84adb7937ed62e1
MD5 6f89f361fc15681705bbab66e15506b3
SHA1 7c4b130a45902fbd05a17618aa1e7e8aaed4bc6d
SHA512 e1281b100b326910c8b9f903924332309542a31b99c741c4a2bbf7189922617da68ae6771f1c646cf3e584c6a0e9be8997050a947cd03c7940bfb868f278112d
SSDEEP 192:m6KI16BveuiSxW6Z+QM/4YNtGcGsBGFNJP1GrCBR97pEFidMWlJdxqHbrqH41x:g/di+EfAvccdMWlJj+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161709713.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161709713.exe
Size 13KB
SHA256 237f68de4cc93b1c10c12c089c374fef31f15d501e7c62f7dc8dee916432bba1
MD5 6bbdc3ad78da42738271f51557f5b83a
SHA1 da847689d816cc8e0ee0b094ac9a582421553368
SHA512 2aab3475691a6afb6745a18eff1b8bbba5fe19df3a685bb54316407936de74fb24cf9d4a92c38853c4e5acaa358159124500663283a1fde71e0467d13fcc11f5
SSDEEP 192:tKTI1fC4APTyjm6SOO9Rvnf5ffhdsXpiDMPl5CgT/m7Tl9GFWlJdxqHKM1x:CRJPuju57DI8blgFWlJj+b
MD5 SHA1 SHA512 SSDEEP

Submit Download

242603161720088.exe

Path C:\Users\Admin\AppData\Local\Temp\242603161720088.exe
Size 13KB
SHA256 69fee265bbcd5f5f3883f63d935b49c699dd060ac4acb77a1bfdb24364617cef
MD5 7d9f0413f993c6ee1997f3724b37c2ed
SHA1 d7fdc67c0b96f19582e239629af2a7b58b9d0b9c
SHA512 100de367b5350d6a2f54c3bb70122ee0bda54fb6b3f27a4a2b66df8b7d6dee8026122a66874dd1b44639234e1b6a6d542d4222b2dd1e3a1b7850aa05c135b5f6
SSDEEP 192:NrSwI1VAXtx+t6BpbHu0iX3tslCPB/O/emyrcAFtGqWlJdxqHbrDVT1x:IwxXaBslPAFQqWlJj+n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads