1937e58368d011938ba8207b960bd7ebc881ac9e6f09ad25a2e3bdfce255b93c

Analysis

max time kernel
142s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
Size

416KB
MD5

275e42090d20bdfc4d434c840c1a8240
SHA1

49ff65a1b81255f57ebc408e4d2632e1d6ead542
SHA256

1937e58368d011938ba8207b960bd7ebc881ac9e6f09ad25a2e3bdfce255b93c
SHA512

936a4f766a516a45840bfc6a75e55e8ac08d5a0e4e5e157b186e9d3397674b69ccb22697bab1f547d33caf27dcc2e6e857363627575c2ee365412fb597715030
SSDEEP

6144:AewfUVIhGEY4MBPd/DvQGZl079H0W7cyqCxSngmMBqfycuPbUl0i5cD5J6KE:AeusKGEY4MBPdVY7j0npM4dl0v5JdE

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
552	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
552	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2740	2784	WerFault.exe	81
2428	552	WerFault.exe	88
3180	552	WerFault.exe	88
1000	552	WerFault.exe	88
1148	552	WerFault.exe	88
4260	552	WerFault.exe	88
4948	552	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2784	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
552	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 552	2784	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe	88
PID 2784 wrote to memory of 552	2784	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe	88
PID 2784 wrote to memory of 552	2784	275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 384
  2⤵
  - Program crash
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 352
    3⤵
    - Program crash
    PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 768
    3⤵
    - Program crash
    PID:3180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 808
    3⤵
    - Program crash
    PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 816
    3⤵
    - Program crash
    PID:1148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 776
    3⤵
    - Program crash
    PID:4260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 796
    3⤵
    - Program crash
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2784 -ip 2784
1⤵
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 552 -ip 552
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 552 -ip 552
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 552 -ip 552
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 552 -ip 552
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 552 -ip 552
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 552 -ip 552
1⤵
PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe

Filesize
416KB

MD5
91e2e817327d4fee41849c8a909a2d4c

SHA1
32b0688957578c186ccd219e02904bdf61bf25c5

SHA256
85e8928aa834501aa800ff018641b85feda2245f2bff76dfc7c68f3c806097b1

SHA512
5b5311a92a023e776b02c29fbdaf2d341f3ed38a2792bc84606893fe499e3eec9a7ad9ac206bc5df574a19a4d623136a55eb37a9a2dd5dba570041511bd443cc

Download Submit
memory/552-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/552-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/552-8-0x0000000001530000-0x0000000001571000-memory.dmp

Filesize
260KB

Download
memory/2784-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2784-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download