Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 23:02
Behavioral task
behavioral1
Sample
4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe
-
Size
134KB
-
MD5
4b47dd9a78fb2810a0befad0cb5ae4e0
-
SHA1
d534b51e6a12065edd559008f645d6e6d525e627
-
SHA256
146a190b5140a11a41657634591b108512958c22b3019bdea75867a877b1af03
-
SHA512
220111dad91372199d1b4a7df8a4de5970fa830f200972681759d6a83fab0bda5f7dd14487e2d35b6a5bb1e53f8ab1a0d7cd2894f1570e6dc6061a5b42a11f2d
-
SSDEEP
1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QY:riAyLN9aa+9U2rW1ip6pr2At7NZuQY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2012 WwanSvc.exe -
Loads dropped DLL 1 IoCs
pid Process 1868 4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1868-0-0x0000000000080000-0x00000000000A8000-memory.dmp upx behavioral1/files/0x00330000000134e6-2.dat upx behavioral1/memory/2012-7-0x0000000000810000-0x0000000000838000-memory.dmp upx behavioral1/memory/1868-8-0x0000000000080000-0x00000000000A8000-memory.dmp upx behavioral1/memory/1868-10-0x0000000000080000-0x00000000000A8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run" 4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2012 1868 4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe 28 PID 1868 wrote to memory of 2012 1868 4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe 28 PID 1868 wrote to memory of 2012 1868 4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe 28 PID 1868 wrote to memory of 2012 1868 4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4b47dd9a78fb2810a0befad0cb5ae4e0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\ProgramData\Update\WwanSvc.exe"C:\ProgramData\Update\WwanSvc.exe" /run2⤵
- Executes dropped EXE
PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD558542c38c32f1d5202baa8ec056b5408
SHA192e5110b1e4ffff2beda12cb3d48a2f70ae91653
SHA2569587f009c2ea85ddb24e26978dbb5d784906101fe6f82e23a7048e0e78330647
SHA512cc9a0d962630e6de3b91f9b25185b49c6b66fb22e31aeacab9313b5c8dae386243b5f6b5a3b8798a56dc6987b50fa72c5f65ca27456390bcb60e3c4b0061a130