Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe
-
Size
133KB
-
MD5
49c86f3d6b110d39cdb9cc6568836110
-
SHA1
304453b1dfab2041077095dde8a2d2952ed58d7c
-
SHA256
99099442b50b43c08847412a31c78ca2a46a984e3fdfdbbc66ddf2d74bfcbd94
-
SHA512
4b898209dfb1fd00cc98a6d136107851338b598fcd5c9e4a05003928aebf3fd1360ee8376094a96e1e6eb994e68c962f109ec399227fd05a2e9eb8da240e2f8e
-
SSDEEP
3072:cEboFVlGAvwsgbpvYfMTc72L10fPsout6nnn:bBzsgbpvnTcyOPsoS6nnn
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2428 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1940 KVEIF.jpg -
Loads dropped DLL 4 IoCs
pid Process 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 2428 svchost.exe 1940 KVEIF.jpg 1932 svchost.exe -
resource yara_rule behavioral1/memory/3064-5-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-2-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-3-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-13-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-11-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-9-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-7-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-15-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-25-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-29-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-27-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-23-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-21-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-19-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-17-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-32-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-33-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/3064-31-0x0000000001C70000-0x0000000001CC5000-memory.dmp upx behavioral1/memory/2428-90-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-102-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-100-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-98-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-96-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-94-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-92-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-88-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-86-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-84-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-82-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-80-0x00000000001B0000-0x0000000000205000-memory.dmp upx behavioral1/memory/2428-79-0x00000000001B0000-0x0000000000205000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kernel64.dll 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\kernel64.dll 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3064 set thread context of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 1940 set thread context of 1932 1940 KVEIF.jpg 31 -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\web\606C646364636479.tmp 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe File opened for modification C:\Windows\web\606C646364636479.tmp 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1940 KVEIF.jpg -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 1940 KVEIF.jpg 1940 KVEIF.jpg 1940 KVEIF.jpg 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 2428 svchost.exe 1932 svchost.exe 2428 svchost.exe 1932 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 2428 svchost.exe 1932 svchost.exe 2428 svchost.exe 1932 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 2428 svchost.exe 1932 svchost.exe 1932 svchost.exe 1932 svchost.exe 2428 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2428 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe Token: SeDebugPrivilege 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe Token: SeDebugPrivilege 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe Token: SeDebugPrivilege 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe Token: SeDebugPrivilege 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe Token: SeDebugPrivilege 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1940 KVEIF.jpg Token: SeDebugPrivilege 1940 KVEIF.jpg Token: SeDebugPrivilege 1940 KVEIF.jpg Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 2428 svchost.exe Token: SeDebugPrivilege 1932 svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 3064 wrote to memory of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 3064 wrote to memory of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 3064 wrote to memory of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 3064 wrote to memory of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 3064 wrote to memory of 2428 3064 49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe 28 PID 1864 wrote to memory of 1940 1864 cmd.exe 30 PID 1864 wrote to memory of 1940 1864 cmd.exe 30 PID 1864 wrote to memory of 1940 1864 cmd.exe 30 PID 1864 wrote to memory of 1940 1864 cmd.exe 30 PID 1940 wrote to memory of 1932 1940 KVEIF.jpg 31 PID 1940 wrote to memory of 1932 1940 KVEIF.jpg 31 PID 1940 wrote to memory of 1932 1940 KVEIF.jpg 31 PID 1940 wrote to memory of 1932 1940 KVEIF.jpg 31 PID 1940 wrote to memory of 1932 1940 KVEIF.jpg 31 PID 1940 wrote to memory of 1932 1940 KVEIF.jpg 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49c86f3d6b110d39cdb9cc6568836110_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 02⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\system32\cmd.execmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F5658401⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F5658402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 03⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD56ced2d84bfc8a467590e78f204dc2725
SHA156e7b47fd47bd18dfffcb81759a628d9ec30168e
SHA25615b99175d2b2e59d7e020359ab45393ff43afc10792c85fbbb1df77d4c7f987e
SHA51291e68353136a0d17feda24203d75cf45de5184676a8607df1cef63eff4aabd02f92bc1b0dfdcefccfcef72a9e49a80174191ec0c81cde7bc2a16a1f681e79693
-
Filesize
108KB
MD5f697e0c5c1d34f00d1700d6d549d4811
SHA1f50a99377a7419185fc269bb4d12954ca42b8589
SHA2561eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202
-
Filesize
133KB
MD5b1c350f056c17a8b5cab82d86f207e3a
SHA19de68967dbbca5b89bbc52004534afb8062ab99b
SHA256c2087a86c19e0b443423b0bc6f7f0f57b54e615331c9bd1b6010e8278f97c4bd
SHA512980b9283879ba07600f707bca576b705c721caf1554bd7875036a905192ed1498ffd28d37463a1ce30cedd41b207061bbf40267379eb0e6c769f6906547846c5
-
Filesize
711B
MD50d9c6664a435fc665462390ec9f908fc
SHA1dc9fcf54679f5bd90428e01d4cbfa94047c5d229
SHA256a085d02137747c5eb0764a12574766933b0a2810cc9625f16a53da6c7e86a756
SHA512ac490c6ddc8c45f975c730736f28f571ae770459ef90b26017cc9ad1e1443dad09a18e40929d8c0cab7b23f145f063d956b8732e8f6b96ebfc4541bcebf69c32
-
Filesize
22B
MD5930acf89790980bda3854f8bd8dc44d6
SHA14033478772bd5b31cdbf85187ad30eb03a560f33
SHA25634158e7ba9674f6eb03866767791fb29663241342a304cbc1286bdaf049269a6
SHA51287752859deee77287cf49d0f54f92dee94f49b2ef3c4fd76ee0b573f1cd73b3b9b472ce4f83e8ae11a8b71aa1c0a802c72b87f7fd940a6b3ddce4d85ab68b7b8
-
Filesize
87B
MD5e16ccf35d9dc3111e22dde5160a41a5f
SHA133c76de11d95530f8c506c238d60fd3924a0b95b
SHA256c6ef6592c5449d83e67e243916dec4a027d2288f93e586beaad25e7e1c462161
SHA512aeedaf01520341a13e496ec8d989859eb8cf23434bd062018c2bb03c1aa0589d19ba23b284a29150914436ea4704503605541fdec808cba4faee8ad905c6c03e
-
Filesize
133KB
MD505d3dfddff4f8a938fe423c45485ff6e
SHA114f8b5481b0e12bff1de4a3d8d084d2d60f4a0d9
SHA25659a14e18b713f8b1328731ad59bd238ac8887e1a4a8ee599445456a16ec86c3a
SHA5126b08a9c0ce8fb99758123cdc67a7858f69671d314932d6ef2c213c6959f45ec7b36ce2b668c881e5d8e4ba6f47c03bc91fdf9692468b51356f1c0c15ba0cad59
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
