Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 00:39
General
- Target 50d0af0715fe286962c6af5e1e56c980_NeikiAnalytics.exe
- Size 1.1MB
- Sample240613-az22la1dpl
- SHA256 de5d995e3eb0c3e076a335bcff8cee91053937a26d5d498c841639796a700258
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Program crash 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50d0af0715fe286962c6af5e1e56c980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\50d0af0715fe286962c6af5e1e56c980_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 4002⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\50d0af0715fe286962c6af5e1e56c980_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\50d0af0715fe286962c6af5e1e56c980_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 3643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3340 -ip 33401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4608 -ip 46081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
50d0af0715fe286962c6af5e1e56c980_NeikiAnalytics.exe
memory/3340-0-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3340-6-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4608-7-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4608-8-0x0000000000400000-0x000000000041A000-memory.dmp
memory/4608-13-0x0000000004DA0000-0x0000000004DE2000-memory.dmp