Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe
-
Size
92KB
-
MD5
162d531ce27bce491c25c2b82a6899a0
-
SHA1
1b0010aefb1eefa3e390c43edcdf62a97c0dfc63
-
SHA256
c8ffc9326f12fc442435cf16bd59e4738930a50b663d20f3ca11d98cf31634ba
-
SHA512
478552171414d9c8fefd6900d4ab9b2f5aca228671291a654eac915c645233561a17218948d8948914a3e0b9408f976e3f469e49492fd71c4b909aff21da02d4
-
SSDEEP
1536:Gc1Tzy48untU8fOMEI3jyYffiuOD2/lUVyIy:GWzltUeOsK52yty
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2832 2232 162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe 29 PID 2232 wrote to memory of 2832 2232 162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe 29 PID 2232 wrote to memory of 2832 2232 162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe 29 PID 2232 wrote to memory of 2832 2232 162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe 29 PID 2832 wrote to memory of 2324 2832 cmd.exe 30 PID 2832 wrote to memory of 2324 2832 cmd.exe 30 PID 2832 wrote to memory of 2324 2832 cmd.exe 30 PID 2832 wrote to memory of 2324 2832 cmd.exe 30 PID 2324 wrote to memory of 2652 2324 iexpress.exe 31 PID 2324 wrote to memory of 2652 2324 iexpress.exe 31 PID 2324 wrote to memory of 2652 2324 iexpress.exe 31 PID 2324 wrote to memory of 2652 2324 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\23B6.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\162d531ce27bce491c25c2b82a6899a0_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2652
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
92KB
MD5503a058a9695c89dcc02b18fda381d7f
SHA18aa589b5e9760261280532679dc9b50628f112ff
SHA256105508ae21dc0e1ebb5181f2a050befdc0ee247bd0024ab30a96d93a3ccda860
SHA5120ae550d4b4f80b8293431ce6a604512320d0322b901f065c1f0542dcd38943e50054378992f7df0897facec26559878154a8b1b0eb93a1b37628043fd14e3778
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083