Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

54b46248c7...cs.dll

windows7-x64

7

54b46248c7...cs.dll

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 01:49 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54b46248c7c2da56a211e641c2de4b40_NeikiAnalytics.dll

  • Size

    76KB

  • MD5

    54b46248c7c2da56a211e641c2de4b40

  • SHA1

    a61f9a494f7de29bd0ab0e216af4b1cb9bbf6044

  • SHA256

    bed62037ce0440926d8bc5b0d95ad659c9a1fab0c6d6403ff3963fff1d8c3a91

  • SHA512

    a8af9ebbe939216b14e32d4c4c974b9669ef291968339f0d32d3af54a2bbe0b04ae0d59d6beaee61faab2a5944aa195ca4ef3d3c88f59f76a1e739a1f8e05a5d

  • SSDEEP

    1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z51QUC:c8y93KQjy7G55riF1cMo03Rq

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\54b46248c7c2da56a211e641c2de4b40_NeikiAnalytics.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\54b46248c7c2da56a211e641c2de4b40_NeikiAnalytics.dll,#1
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 704
        3⤵
        • Program crash
        PID:4652
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1104 -ip 1104
    1⤵
      PID:4676
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4252

      Network

      • flag-us
        DNS
        217.106.137.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.106.137.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        14.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        0.204.248.87.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.204.248.87.in-addr.arpa
        IN PTR
        Response
        0.204.248.87.in-addr.arpa
        IN PTR
        https-87-248-204-0lhrllnwnet
      • flag-us
        DNS
        76.234.34.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        76.234.34.23.in-addr.arpa
        IN PTR
        Response
        76.234.34.23.in-addr.arpa
        IN PTR
        a23-34-234-76deploystaticakamaitechnologiescom
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        183.142.211.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.142.211.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        183.142.211.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.142.211.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        91.90.14.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.90.14.23.in-addr.arpa
        IN PTR
        Response
        91.90.14.23.in-addr.arpa
        IN PTR
        a23-14-90-91deploystaticakamaitechnologiescom
      • flag-us
        DNS
        11.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        11.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        6.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        6.173.189.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        6.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        6.173.189.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        6.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        6.173.189.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        6.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        6.173.189.20.in-addr.arpa
        IN PTR
      • 96.16.110.114:80
        260 B
         5
      • 142.250.187.234:443
        46 B
         40 B
         1
        1
      • 13.107.246.64:443
        46 B
         40 B
         1
        1
      • 8.8.8.8:53
        217.106.137.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        217.106.137.52.in-addr.arpa

      • 8.8.8.8:53
        14.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        14.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        0.204.248.87.in-addr.arpa
        dns
        71 B
         116 B
         1
        1

        DNS Request

        0.204.248.87.in-addr.arpa

      • 8.8.8.8:53
        76.234.34.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        76.234.34.23.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        133.211.185.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        133.211.185.52.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        140 B
         144 B
         2
        1

        DNS Request

        18.31.95.13.in-addr.arpa

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        183.142.211.20.in-addr.arpa
        dns
        146 B
         159 B
         2
        1

        DNS Request

        183.142.211.20.in-addr.arpa

        DNS Request

        183.142.211.20.in-addr.arpa

      • 8.8.8.8:53
        91.90.14.23.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        91.90.14.23.in-addr.arpa

      • 8.8.8.8:53
        11.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        11.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        6.173.189.20.in-addr.arpa
        dns
        284 B
         157 B
         4
        1

        DNS Request

        6.173.189.20.in-addr.arpa

        DNS Request

        6.173.189.20.in-addr.arpa

        DNS Request

        6.173.189.20.in-addr.arpa

        DNS Request

        6.173.189.20.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1104-0-0x0000000010000000-0x0000000010030000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1104-1-0x0000000010000000-0x0000000010030000-memory.dmp

        Filesize

        192KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.