Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 16:09
Behavioral task
behavioral1
Sample
6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe
-
Size
41KB
-
MD5
6ae1dcf9bb992a43bde386cc50307480
-
SHA1
2dd9d531eeb9ae708c03f329010a914feeeb35f7
-
SHA256
48c778d11922adc7f82f7a475e5036e0acffd4667623d7113cd45bd81760a595
-
SHA512
6470327f72a07d633699e0b42c828bae5b6315bfcacb307c754f796dcb6334e8b7e6111b784c845ed2c0af747c1c45b8065c7feb8d04720590e4b891d320e4f6
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4128 services.exe -
resource yara_rule behavioral2/memory/2356-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x0008000000023241-4.dat upx behavioral2/memory/4128-5-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2356-13-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4128-14-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-19-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-24-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-36-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-43-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-48-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-50-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4128-55-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2356-56-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4128-57-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2356-61-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x00030000000006e3-69.dat upx behavioral2/memory/4128-116-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2356-117-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/4128-170-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe File opened for modification C:\Windows\java.exe 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe File created C:\Windows\java.exe 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4128 2356 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe 90 PID 2356 wrote to memory of 4128 2356 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe 90 PID 2356 wrote to memory of 4128 2356 6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6ae1dcf9bb992a43bde386cc50307480_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:3428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
41KB
MD5e91f1f0fa8d262ca80359d7d2a24baec
SHA14c42d180b9df5ac0465af71463cb557b485bf3aa
SHA2564499c8943413aa87aff806c01abaef32263af20a687e475ec01f2081169d7f6d
SHA51226718a492cfd6b2e44bed27c7d44e18f590eea9cd200122d42ecf27b7ed076f2220fca2c80ee1132a5666857705849e0a6418f5b5a63cc161d38a70d09e3e167
-
Filesize
160B
MD53ba5f6f49b0e92cc77ee5ef20891a86f
SHA18e9413f903f9cee6a5d3948eec2ed398e0570f96
SHA2564ac5425c4b6c298b8980c8bb72f361bdafe730d06125a2131634d45adcd0ecad
SHA5126e1d0b600573a6eb5ab20d0b043d24d8083b144aa20c4319f01c5983607f16165122586fe677c914efde5ee78bc8fcd55ec67f264cb21954399dd5d683a82586
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2