5f9f6878cf57e516c70d07d645a7a769cfcac11ee3c0cc6ac853613264555ff0

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe
Size 944KB
Sample240613-bf48aayckc
SHA256 5f9f6878cf57e516c70d07d645a7a769cfcac11ee3c0cc6ac853613264555ff0
MD5 5274dbee08faa5da4935640abc59a720
SHA1 c3c957d87a5d12c0afa29929d2dfaf4f350802a5
SHA512 cc6567ac797a11a4d4c18a929afd0d0c37173aea7063e8e3e4ef85e11f4298ca2fe9880f275533cc83b5b3b94f62c0ac5906fd9bba7e16fe10628d37d5611213
SSDEEP 24576:XLQF/naPbT5LaUSxQt6bC7vX76X4K3teXnUNvA7xNvSa/ZS/QERT77Ld:XLwqFang7cx3tenUN4lNvSggQERTbd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2352	5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2352	5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1736	4824	WerFault.exe	88
2468	2352	WerFault.exe	96
1524	2352	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4824	5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2352	4824	5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe	96
PID 4824 wrote to memory of 2352	4824	5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe	96
PID 4824 wrote to memory of 2352	4824	5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 344
  2⤵
  - Program crash
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 348
    3⤵
    - Program crash
    PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 168
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 4824
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2352 -ip 2352
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2352 -ip 2352
1⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\5274dbee08faa5da4935640abc59a720_NeikiAnalytics.exe
Size 944KB
SHA256 54960f68458c5babc858d03660c23f55f4ac46c4a39c701549c321204caf9203
MD5 69667de240ec05689d32c68bbde99a98
SHA1 b748f44353c307a906e041a5c50faa458fcc46a0
SHA512 7a6c10faf8dbd4709489a8f96e88464bfaa24a99bd2ead13105884a3eeeed30dc4fd83bc1508c632c688d66d55bbdb3f93fad0c27a99fe7e22a0bc79c9c4c913
SSDEEP 24576:/2+2h5s1xS38Z+gLJBd7jG0zwX3xMKfQRwEcVa/ZS/QERT77Ld:/EOxS38Z+OxS0zS3XQRwEcVggQERTbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2352-6-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/2352-8-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/4824-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/4824-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads