68b902ccc2430184b75dc3a49fdd887944f0027f26db9a4c81c85552bf24500d

General

Target

573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe
Size

1.6MB
MD5

573f53e9345b735f06f0d213dab13050
SHA1

d0f95434d42f409711ba61ae8fb40ec3e30cb589
SHA256

68b902ccc2430184b75dc3a49fdd887944f0027f26db9a4c81c85552bf24500d
SHA512

e427f448794812155855b30ce4c9b269a621eece020c210a22a69938ea297009496a67e6db34743f4338a005731c22dcc00615f279064a483041673f429d7999
SSDEEP

49152:q7VP8clLlObWgtWl4mrbYE+3Mq0deC76CHdRyD:qecl8Wl4mrE9SQC76CHdRyD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4752	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4752	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	pastebin.com
20	pastebin.com

Program crash 15 IoCs

pid	pid_target	Process	procid_target
388	3212	WerFault.exe	89
3544	4752	WerFault.exe	97
4520	4752	WerFault.exe	97
1800	4752	WerFault.exe	97
1980	4752	WerFault.exe	97
4268	4752	WerFault.exe	97
1540	4752	WerFault.exe	97
532	4752	WerFault.exe	97
2372	4752	WerFault.exe	97
3408	4752	WerFault.exe	97
4880	4752	WerFault.exe	97
116	4752	WerFault.exe	97
2036	4752	WerFault.exe	97
1352	4752	WerFault.exe	97
228	4752	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4752	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe
4752	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3212	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4752	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4752	3212	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe	97
PID 3212 wrote to memory of 4752	3212	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe	97
PID 3212 wrote to memory of 4752	3212	573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe	97

C:\Users\Admin\AppData\Local\Temp\573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 344
  2⤵
  - Program crash
  PID:388
- C:\Users\Admin\AppData\Local\Temp\573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 344
    3⤵
    - Program crash
    PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 628
    3⤵
    - Program crash
    PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 648
    3⤵
    - Program crash
    PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 648
    3⤵
    - Program crash
    PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 708
    3⤵
    - Program crash
    PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 892
    3⤵
    - Program crash
    PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1412
    3⤵
    - Program crash
    PID:532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1488
    3⤵
    - Program crash
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1508
    3⤵
    - Program crash
    PID:3408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1696
    3⤵
    - Program crash
    PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1712
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1656
    3⤵
    - Program crash
    PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1564
    3⤵
    - Program crash
    PID:1352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 632
    3⤵
    - Program crash
    PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3212 -ip 3212
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4752 -ip 4752
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4752 -ip 4752
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4752 -ip 4752
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4752 -ip 4752
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4752 -ip 4752
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4752 -ip 4752
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4752 -ip 4752
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4752 -ip 4752
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4752 -ip 4752
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4752 -ip 4752
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4752 -ip 4752
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4752 -ip 4752
1⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4752 -ip 4752
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4752 -ip 4752
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\573f53e9345b735f06f0d213dab13050_NeikiAnalytics.exe

Filesize
1.6MB

MD5
411c144c803786e0a4fe344dfdba71d2

SHA1
de4e65ab9506fc033e48a8955975fa0133021f6b

SHA256
ed4fef6d8c2c54b05825eb054bce31ea6dcf3dc20b87382407eb052afe2293a0

SHA512
26e231726a0bcf2b080ab5fd5b798e031aedf71b5e79f1d9eed347a88c1915f236ed4b0e25f9a243137c46385ff4bd1d542975b0b315864fe6fee5a373e97809

Download Submit
memory/3212-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/3212-6-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/4752-7-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/4752-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4752-14-0x0000000005090000-0x0000000005182000-memory.dmp

Filesize
968KB

Download
memory/4752-22-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4752-27-0x000000000B9C0000-0x000000000BA63000-memory.dmp

Filesize
652KB

Download
memory/4752-28-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing