f6fef3a9f78b32c633b7cdd4ebe85cf702321f17b248ba320415746ee16e03c7

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe
Size

197KB
MD5

040fd17380569c0a6dff1bbab247de20
SHA1

1ef10615a6202bc9c386bd3b927a43ed78e0a097
SHA256

f6fef3a9f78b32c633b7cdd4ebe85cf702321f17b248ba320415746ee16e03c7
SHA512

593c230e8356392ca51abf2d473472f881aea0ed7c9fca97cd05a0d63f508fa9b25896b9c2525194261fa330aa8e8ec2c2a12eaa13a962151add6985e3bb6f54
SSDEEP

6144:b+6RQuMqjDWOheaKzTVpTnRTTSn3RyeKHCyGH6Y6l:K1uMqvWOozzTVpTnRTTSnB1KHCyfv

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2024	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2024	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4040	2180	WerFault.exe	82
2592	2024	WerFault.exe	88
4948	2024	WerFault.exe	88
1864	2024	WerFault.exe	88
3940	2024	WerFault.exe	88
4284	2024	WerFault.exe	88
3700	2024	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2180	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2024	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2024	2180	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe	88
PID 2180 wrote to memory of 2024	2180	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe	88
PID 2180 wrote to memory of 2024	2180	040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 384
  2⤵
  - Program crash
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 352
    3⤵
    - Program crash
    PID:2592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 768
    3⤵
    - Program crash
    PID:4948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 772
    3⤵
    - Program crash
    PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 768
    3⤵
    - Program crash
    PID:3940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 808
    3⤵
    - Program crash
    PID:4284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 784
    3⤵
    - Program crash
    PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2180 -ip 2180
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 2024
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2024 -ip 2024
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2024 -ip 2024
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2024 -ip 2024
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2024 -ip 2024
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2024 -ip 2024
1⤵
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\040fd17380569c0a6dff1bbab247de20_NeikiAnalytics.exe

Filesize
197KB

MD5
8f0be9c60d872023f7e4d14d5abad7e8

SHA1
44763ebec9a4b0b75e20ab0c8c3971139e1ee8da

SHA256
63da131769622e11ff7933befedbcfd0740739417f925c559c213a703be0899f

SHA512
e43601fedab3516ab8f0ce477c0eb607ca1d7c229ab83058fb96e696c57e8ad06a9dad8f69999c47f068d2d2917eebdf2dce3c47f542bc9ea7bd1589900b48ae

Download Submit
memory/2024-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2024-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2024-13-0x00000000014C0000-0x00000000014FF000-memory.dmp

Filesize
252KB

Download
memory/2024-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2180-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2180-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download