Analysis
- max time kernel
133s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 17:52
General
- Target ebfea638aba1efd69aa56638001ae2c0_NeikiAnalytics.dll
- Size 273KB
- Sample240603-wfp4ksfd55
- SHA256 f4b4fe1e69eaffe323eb29a17186d1f309f418c183e88e7d18e3f73e8d8b9508
Malware Config
Signatures
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in System32 directory 1 IoCs
- Program crash 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebfea638aba1efd69aa56638001ae2c0_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebfea638aba1efd69aa56638001ae2c0_NeikiAnalytics.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 4284⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6083⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5068 -ip 50681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2180 -ip 21801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
~TM54B7.tmp
rundll32mgr.exe
memory/2180-11-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2180-15-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/2180-5-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2180-10-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2180-19-0x0000000077312000-0x0000000077314000-memory.dmp
memory/2180-18-0x0000000077312000-0x0000000077313000-memory.dmp
memory/2180-21-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2180-9-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2180-14-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2180-8-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2180-7-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2180-6-0x0000000000400000-0x000000000042A000-memory.dmp
memory/5068-2-0x0000000074D30000-0x0000000074D7A000-memory.dmp
memory/5068-22-0x0000000074D30000-0x0000000074D7A000-memory.dmp