66a2545f0d2b9911ae65fa5a847dbed64e6b407c969b18c85480f0834202a276

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15617086b3d00a476b9eae764807ca50_NeikiAnalytics.exe
Size 12KB
Sample240604-27jc1afe53
SHA256 66a2545f0d2b9911ae65fa5a847dbed64e6b407c969b18c85480f0834202a276
MD5 15617086b3d00a476b9eae764807ca50
SHA1 4da2a1d436e77e4664567a2b3586b8a2db7ed173
SHA512 d9883a7f4b6794f8e71d20c3ba41c1b2e5ac78359a6cecc67c52602a740a9310a117c0869d8a961d52f633be4f1573aa37ba36a0f17c0bbe6be0c266d9f385a3
SSDEEP 192:Zb6OET5EPtuS9siC6poIKuLxOj0RdkEh2byItTbo2rWlCsC1imWlJdxqHXrqfy:ectrv8Ud3jeVWlJj+T
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4988	240604231324575.exe
4304	242604231332700.exe
3588	242604231346621.exe
4876	242604231428387.exe
4684	242604231443153.exe
1084	242604231454028.exe
3160	242604231503858.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 2232	3844	15617086b3d00a476b9eae764807ca50_NeikiAnalytics.exe	93
PID 3844 wrote to memory of 2232	3844	15617086b3d00a476b9eae764807ca50_NeikiAnalytics.exe	93
PID 2232 wrote to memory of 4988	2232	cmd.exe	94
PID 2232 wrote to memory of 4988	2232	cmd.exe	94
PID 4988 wrote to memory of 1576	4988	240604231324575.exe	100
PID 4988 wrote to memory of 1576	4988	240604231324575.exe	100
PID 1576 wrote to memory of 4304	1576	cmd.exe	101
PID 1576 wrote to memory of 4304	1576	cmd.exe	101
PID 4304 wrote to memory of 4660	4304	242604231332700.exe	104
PID 4304 wrote to memory of 4660	4304	242604231332700.exe	104
PID 4660 wrote to memory of 3588	4660	cmd.exe	105
PID 4660 wrote to memory of 3588	4660	cmd.exe	105
PID 3588 wrote to memory of 556	3588	242604231346621.exe	106
PID 3588 wrote to memory of 556	3588	242604231346621.exe	106
PID 556 wrote to memory of 4876	556	cmd.exe	107
PID 556 wrote to memory of 4876	556	cmd.exe	107
PID 4876 wrote to memory of 5008	4876	242604231428387.exe	108
PID 4876 wrote to memory of 5008	4876	242604231428387.exe	108
PID 5008 wrote to memory of 4684	5008	cmd.exe	109
PID 5008 wrote to memory of 4684	5008	cmd.exe	109
PID 4684 wrote to memory of 1540	4684	242604231443153.exe	110
PID 4684 wrote to memory of 1540	4684	242604231443153.exe	110
PID 1540 wrote to memory of 1084	1540	cmd.exe	111
PID 1540 wrote to memory of 1084	1540	cmd.exe	111
PID 1084 wrote to memory of 2136	1084	242604231454028.exe	112
PID 1084 wrote to memory of 2136	1084	242604231454028.exe	112
PID 2136 wrote to memory of 3160	2136	cmd.exe	113
PID 2136 wrote to memory of 3160	2136	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\15617086b3d00a476b9eae764807ca50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15617086b3d00a476b9eae764807ca50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\240604231324575.exe 000001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Users\Admin\AppData\Local\Temp\240604231324575.exe
    C:\Users\Admin\AppData\Local\Temp\240604231324575.exe 000001
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242604231332700.exe 000002
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\242604231332700.exe
        
        C:\Users\Admin\AppData\Local\Temp\242604231332700.exe 000002
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4304
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242604231346621.exe 000003
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\242604231346621.exe
        
        C:\Users\Admin\AppData\Local\Temp\242604231346621.exe 000003
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242604231428387.exe 000004
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\242604231428387.exe
        
        C:\Users\Admin\AppData\Local\Temp\242604231428387.exe 000004
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242604231443153.exe 000005
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\242604231443153.exe
        
        C:\Users\Admin\AppData\Local\Temp\242604231443153.exe 000005
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242604231454028.exe 000006
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\242604231454028.exe
        
        C:\Users\Admin\AppData\Local\Temp\242604231454028.exe 000006
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\242604231503858.exe 000007
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\242604231503858.exe
        
        C:\Users\Admin\AppData\Local\Temp\242604231503858.exe 000007
        15⤵
        Executes dropped EXE
        
        PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240604231324575.exe

Path C:\Users\Admin\AppData\Local\Temp\240604231324575.exe
Size 13KB
SHA256 d9e00338ee0063b48535295cfd5de976c4424c50daef89d49a04139cef9c5cda
MD5 6e1c1be928384496366dbdb9f782f61d
SHA1 d6e2dd4987f6087d296bf28a1f2014eaf54f84af
SHA512 f2bfb9cf861098c6ba37d53eaccf855d3c58ab73a59f9179dbc740c9302828d8514bcca7740db677a16a2a1fad529ac33ba56f1332d2f1dc8ab2bb3a05cf3e89
SSDEEP 192:MBf3I1tVFBnbyn6a7cfSZW+K5ZHetEzNjJJPSA9loXGuB4nyV0OxyBXSpWlJdxqh:M9sFBbyg6an+oBXSpWlJj+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

242604231332700.exe

Path C:\Users\Admin\AppData\Local\Temp\242604231332700.exe
Size 13KB
SHA256 1646341b5732292d5fb1e75d72ad0f7a37cdda053d410a517f36ab40f8e75b6a
MD5 ba9caa9f47712cdc1c3d7875b752eb03
SHA1 5fc977138305dc4e8dfe82e2b0cd86a47e6aaa21
SHA512 5bbf5eb2671feb703b2059aaa18180362abf87bd4dbd9cc5eaa3eed2599636fba9b37504c4473e6d21e737115082985571ab6871d839cbfd676d3e7867842902
SSDEEP 192:SazI1gRzu0Gzed6ypL4AuTsqsnqpcPBvL3V7omVtGgjWlJdxqHbrPz1xb:Jrzu0GaVIcVQgjWlJj+5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

242604231346621.exe

Path C:\Users\Admin\AppData\Local\Temp\242604231346621.exe
Size 13KB
SHA256 bb2c97fbaec633ea700a84d4ccdb74b83391d358c4af1c885aaa1bb90bfe8d3b
MD5 49289378a2036578f78594b98817c6f9
SHA1 cba85d55c9e929bd76bf5f98e6db0dbc6469feec
SHA512 fbc71fed0a2abac4a19bc5b55118040185cddd251036b9d8a4f97a091d67fa294888ca37fe5262148864cef9ad4c2c4cacfc652579dcb852c9a8c03dc04ab373
SSDEEP 192:WKyI1f/Qiyajm6pMA4fMefWdsXGpZPB7C421rvUh+YCqTWDTWtWlJdxqHaw1x:AsQiZoGpOG+VYWlJj+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

242604231428387.exe

Path C:\Users\Admin\AppData\Local\Temp\242604231428387.exe
Size 13KB
SHA256 e1f75c7009860b56d41ca782b4f4ef8df548d084039ce02e8f991985c6bd8788
MD5 9cab2878284c0ddab4968c533d265c67
SHA1 4e500a98ece464b4a3e5ebffb045c03e8ca6d3b8
SHA512 a53a6d1e2859452650848edad02c4277304b2a00273c49d41ef22dd8fdcbabed16b516ef5a68c182248e79cc1def19d14d1b3b1d67f48e9da82c20d9e86e1232
SSDEEP 192:Rn4I1lYWAKBn8mB6g3lluZbiH4DNIDqMMRPCgfgKpRQoLqyghWlJdxqHbr4AQ1x:iBKym/lBOMMwA7SWlJj+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

242604231443153.exe

Path C:\Users\Admin\AppData\Local\Temp\242604231443153.exe
Size 13KB
SHA256 24bcd809b7f5124858d0d668f4da1b2ae5cd95e32bf7c3b394f6ecf7d9d19059
MD5 ca1b72b1ae8d759a0f45671fcc897b35
SHA1 b4b77a4f1193b87da78288ebc2c4097bd3a80037
SHA512 6ec2aa8dac735b3a67de7ca073b8d3468f1a4b6e61d54cbccdfc24a71b68f59fe45e60e716d77a7524c556b64fdfcb2dc5e9ab63e3da4a1af6b24018c4424ceb
SSDEEP 192:aRyXI1putKqR0e6/M+QaxB33s24DuGmpYcPavNvwqJRI6JyyPWlJdxqHXbAP1x:/eqagIFc2e3NCqDPWlJj+I
MD5 SHA1 SHA512 SSDEEP

Submit Download

242604231454028.exe

Path C:\Users\Admin\AppData\Local\Temp\242604231454028.exe
Size 12KB
SHA256 eca89e35b2f60984685ec3172c30facfb0006ec35d886010ee66f4e48c83460e
MD5 305127272f11fc1148185734dc347360
SHA1 66a1d63530c8b4be939e188d55d51c995162af7d
SHA512 d625647de68557f30cff5494adc50204fcc6781db715c83f958487743f1b1a8a51fb59f7cd18a26b0a45abf14659031fbc3e59e9217d77ad749a1f46741fc559
SSDEEP 192:79oI1Cd26Kxh16losGLNiQhjSluVAbtjbPwOYR/4z5myarWlJdxqHXYr7z1x:G46iuoDOFtjmqzcvWlJj+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

242604231503858.exe

Path C:\Users\Admin\AppData\Local\Temp\242604231503858.exe
Size 12KB
SHA256 edbaaeee82a853344b8b9c8dd2ef6e24f23780e869bb0943bab9c3096163693a
MD5 cd9a98c9345260307204945c6291531f
SHA1 e3c8f9219179da2cdf1d9f692c30dfcbaf6c508e
SHA512 cb997e1694963ef5e359f3b23b401bea37835cc1ffed46c0523242ae186a6e161547466e04e7a33589532452addc096a335d89224d428cebd4cf6b54b575d65b
SSDEEP 192:81z+PV1I1qYi6OME6eMGTw8STtKwEnfEDX7KPsuRF2T0mGWlJdxqHCAf1xdQ:xsi6/ELwEWV5GWlJj+P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads