0480734fca847ba66ac1465be0fd2298b4c0f17a291caf354eba808dc7ee3652

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe
Size

1.2MB
MD5

65eceeba208f3d99f892d9405c518040
SHA1

acef39fc86d534067ea0ee5a9579b6547fe662a1
SHA256

0480734fca847ba66ac1465be0fd2298b4c0f17a291caf354eba808dc7ee3652
SHA512

22a8b44e8798fc4a9a2bb0284920e4e6863980d7d58692c065ba07afb614ad1619013c1b49c0e2671230b7704bc70ad3749665267df97939e8fef01131ae69b3
SSDEEP

24576:4ULPM63iFF6+LtM5sUFDMN6p0Q1lYG6EXa/ZSqa/JX3gK6BbK077Lv+f6T8f//1:9PD+HpM5siDpKQ1mG6ugpg2XB+0bGH1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2052	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2052	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2136	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2052	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2136	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2052	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2052	2136	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe	29
PID 2136 wrote to memory of 2052	2136	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe	29
PID 2136 wrote to memory of 2052	2136	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe	29
PID 2136 wrote to memory of 2052	2136	65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\65eceeba208f3d99f892d9405c518040_NeikiAnalytics.exe

Filesize
1.2MB

MD5
1b1f29b083b8302b5dad3c23f51607e4

SHA1
49bb960d0c511918063839ca82bbc4c6a349007c

SHA256
189607d972886da1928acd54525181eeadc6428e38268ac981bda8d7824e92af

SHA512
a02b7ea9a2dbcb550147631e969214f2c57933c683b70a8cde6bce0a7e39f7afbcf6c35b13da067c7c74e29a56e1435dfcd33712d918f3fcab7531a19f7cc7fb

Download Submit
memory/2052-9-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2052-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/2052-16-0x0000000002E70000-0x0000000002F87000-memory.dmp

Filesize
1.1MB

Download
memory/2052-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2052-37-0x000000000EE50000-0x000000000EEF3000-memory.dmp

Filesize
652KB

Download
memory/2136-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2136-8-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download