Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
-
Size
5.2MB
-
MD5
e742461ec4961f9b4faf228860b8ed10
-
SHA1
7cc31e0320c46668a7ebc7f441534fb841f1b029
-
SHA256
c76a61029081f01222b230ff125938569b7a7dcd0fd68c6edededb30db468044
-
SHA512
744190e7064f1c8b134c0a1937bda549fa281b6aac12ed7d920ef2f8406103da7cdd6dd112ad7f5ef4ed2400e18593603bc4ceb772d63e39b8c55ed2753569f1
-
SSDEEP
98304:IP9UokYumczhd5cQoatkv9LRjmAO3Hv4stpDpvb0koTEC:IP9FNuDzhXcQoatkvXjmTHv4sjR0koT
Malware Config
Signatures
-
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\version_description.xml rundll32.exe File created C:\Windows\SysWOW64\version.xml rundll32.exe File created C:\Windows\SysWOW64\HintSock.dll rundll32.exe File created C:\Windows\SysWOW64\HintSok.dll rundll32.exe File created C:\Windows\SysWOW64\Hintva.dll rundll32.exe File created C:\Windows\SysWOW64\version rundll32.exe File created C:\Windows\SysWOW64\13092618\hintva.dll rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1512 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1512 rundll32.exe Token: SeDebugPrivilege 1512 rundll32.exe Token: SeDebugPrivilege 1512 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1512 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1296 wrote to memory of 1512 1296 rundll32.exe 81 PID 1296 wrote to memory of 1512 1296 rundll32.exe 81 PID 1296 wrote to memory of 1512 1296 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1512
-