Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe
-
Size
88KB
-
MD5
193d37dec9b2aade572a8c0ec52ebc80
-
SHA1
b45bd6a077680e60138adb5de499a1f6b53e91a5
-
SHA256
24513c7931290a00ce6d4024e817ea6facd686d13324b08b1124528c71459836
-
SHA512
c7628ed2ba59f498aad9af73fef2a66e4c23f236624b0bae3c2c4a4e6c37321e7325af95bd8a916d35e772a1bb0a2b5010f9773ec204c479cb3791f7ec097f44
-
SSDEEP
1536:NDj2d6rnJbJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nsqnl1R5:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1Muq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1684 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1684 microsofthelp.exe -
Loads dropped DLL 1 IoCs
pid Process 1684 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1684 microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4260 wrote to memory of 1684 4260 193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe 81 PID 4260 wrote to memory of 1684 4260 193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe 81 PID 4260 wrote to memory of 1684 4260 193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\193d37dec9b2aade572a8c0ec52ebc80_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54c0b9970f96300dfa1f45afc7539d35f
SHA1ebbb4ed2003662d78d1f32e7b6da1b6f504ae711
SHA2564e96660cc8be7171a79755a20860366987547322b3a809e78c9850f14c242262
SHA512579f8787b52bf62a0296d8a24753263201fbc84abec5927033e3c97576f965ead0f8422acd3f7af1345b0df0001b0cd68fa971062e21269f6940cf3e1508ca88
-
Filesize
88KB
MD52f5673b753997328cf28e2f9cf77995e
SHA1ccc74201d5e704417c4addba23a879ea0d51cce5
SHA256a551c1ff5a4f9f326a41aba7cddee089a2579c8ce335070ca5331712e1315cc0
SHA512542124cb8fd4d69332e049f972aa1f9700bddc0dee87b9050b4abb89a37c72ea315789057ba5092d43cfd9821a85066425aa673394fb60f5b938649ead4f9b79