Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
Resource
win7-20240220-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
5 signatures
150 seconds
General
-
Target
e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
-
Size
5.2MB
-
MD5
e742461ec4961f9b4faf228860b8ed10
-
SHA1
7cc31e0320c46668a7ebc7f441534fb841f1b029
-
SHA256
c76a61029081f01222b230ff125938569b7a7dcd0fd68c6edededb30db468044
-
SHA512
744190e7064f1c8b134c0a1937bda549fa281b6aac12ed7d920ef2f8406103da7cdd6dd112ad7f5ef4ed2400e18593603bc4ceb772d63e39b8c55ed2753569f1
-
SSDEEP
98304:IP9UokYumczhd5cQoatkv9LRjmAO3Hv4stpDpvb0koTEC:IP9FNuDzhXcQoatkvXjmTHv4sjR0koT
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\version_description.xml rundll32.exe File created C:\Windows\SysWOW64\version.xml rundll32.exe File created C:\Windows\SysWOW64\HintSock.dll rundll32.exe File created C:\Windows\SysWOW64\HintSok.dll rundll32.exe File created C:\Windows\SysWOW64\Hintva.dll rundll32.exe File created C:\Windows\SysWOW64\version rundll32.exe File created C:\Windows\SysWOW64\13092618\hintva.dll rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2928 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2928 rundll32.exe Token: SeDebugPrivilege 2928 rundll32.exe Token: SeDebugPrivilege 2928 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2928 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2928 2860 rundll32.exe 28 PID 2860 wrote to memory of 2928 2860 rundll32.exe 28 PID 2860 wrote to memory of 2928 2860 rundll32.exe 28 PID 2860 wrote to memory of 2928 2860 rundll32.exe 28 PID 2860 wrote to memory of 2928 2860 rundll32.exe 28 PID 2860 wrote to memory of 2928 2860 rundll32.exe 28 PID 2860 wrote to memory of 2928 2860 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2928
-