1017d78f256191e97624071fe045c2b0a35b99483add2e4cabe8beb5430daf32

Analysis

max time kernel
143s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe
Size 175KB
Sample240605-dhhs6scd2t
SHA256 1017d78f256191e97624071fe045c2b0a35b99483add2e4cabe8beb5430daf32
MD5 2f98dfc66123c9f02d328b4a501689a0
SHA1 e1116154dd03726faff662f1bcc3a0d7c0674611
SHA512 381f40354ac2efba8d19775c4db2800a6ff94195294b0ab9ef3e3ed3c0bfbc840ac4b30d6c5a0cc51792b9b652ee6529dc6bf581713002dc355dbdf20e3bcdd6
SSDEEP 3072:NMII6qz7vhvOVsLx7+9C9lMuA4L5+ZdopOuoWUl1iaS0ajHTg/p8M5:NMvT1OLC9libZNZ7TipP6p8m
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5052	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
5052	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3248	2772	WerFault.exe	84
876	5052	WerFault.exe	88
2488	5052	WerFault.exe	88
4516	5052	WerFault.exe	88
3132	5052	WerFault.exe	88
4616	5052	WerFault.exe	88
4976	5052	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2772	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5052	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 5052	2772	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe	88
PID 2772 wrote to memory of 5052	2772	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe	88
PID 2772 wrote to memory of 5052	2772	2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 388
  2⤵
  - Program crash
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 352
    3⤵
    - Program crash
    PID:876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 768
    3⤵
    - Program crash
    PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 808
    3⤵
    - Program crash
    PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 772
    3⤵
    - Program crash
    PID:3132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 776
    3⤵
    - Program crash
    PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 796
    3⤵
    - Program crash
    PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2772 -ip 2772
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5052 -ip 5052
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5052 -ip 5052
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5052 -ip 5052
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5052 -ip 5052
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5052 -ip 5052
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5052 -ip 5052
1⤵
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\2f98dfc66123c9f02d328b4a501689a0_NeikiAnalytics.exe
Size 175KB
SHA256 5f87296b964c799768dae5a850cc8254371b20fe7b95b479d948b74f05be23e1
MD5 671f3b1f7021cd69d26588c4d2b6554e
SHA1 52382c016cf26f3b13baf6bfc3dba60db9256e50
SHA512 6057c42586adca988b262812d6db75547a78e6a1de24e898396a7330f0b3152b94d5c53e578ab2ddeb13582b35e093f33edf10af61b43e8cebbb92abbcde37bb
SSDEEP 3072:TrFD/mQfP04ENkswfVxzVO6A3ac+nrSSKpk3+58uLN5:tmQn9EismzVcac+nrSSKpk3+58uL7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2772-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2772-7-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5052-8-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5052-9-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5052-14-0x0000000003D70000-0x0000000003DA3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads