Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/06/2024, 09:44

General

  • Target

    3c1fc8811aeeef6b5e857668ec85d8a0_NeikiAnalytics.exe

  • Size

    1.5MB

  • MD5

    3c1fc8811aeeef6b5e857668ec85d8a0

  • SHA1

    f4d87f5c92679e5c63d2d0a45a5f25171331dc23

  • SHA256

    d8d30543bd0138997c6c7c54b46bcde88db5db7a2b196bf758ddac5b4858e2d0

  • SHA512

    7f62262fdecb03e06c170471aa248648d9b08b8b98afa925e4948c9df629ceea333a1d6a901526b18cccf7691be75a972092c36b126bd7670c965e4f9b911cbb

  • SSDEEP

    24576:TaxVJXEdwsnFdxzL3UarLZmN1DUZmSordfq6Ph2kkkkK4kXkkkkkkkkhLX3a20RR:Tax305xzL3xPZmXYZmSadfqkbazR0vI

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c1fc8811aeeef6b5e857668ec85d8a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3c1fc8811aeeef6b5e857668ec85d8a0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\1564.tmp
      "C:\Users\Admin\AppData\Local\Temp\1564.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1564.tmp

    Filesize

    1.5MB

    MD5

    51859c5338062c7604022403adfd85e9

    SHA1

    ce3c945352377cb359b5692c5a1fc0a8cf6edb1b

    SHA256

    58090789250e2aa1e891d5091a2b0e8be44bf50f94575c20350f58e42394e6c7

    SHA512

    9aa1dc4c75117b6bcabc8e7342117f3882e0271e155d9e81ebdcaa9fd6f885f502aaca53c91af70de4c0c8287129ad0b0bf635c8f8a6cec45c0318917880093d