Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 07:38
Static task
static1
Behavioral task
behavioral1
Sample
69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe
-
Size
36KB
-
MD5
69bd2376715fb9458a80e7e527832b00
-
SHA1
17200cc250b5eef179fff58a463bfe8eb017436c
-
SHA256
c8468234c23f6e2a7985cdb3dfda34a3f0a357f762e3e54d369f19d94fb5d7e2
-
SHA512
964d2c3bd8cfe44f4ae7d644bb084d35b171036e9e126d9b71122f7a333837bda20ea0bca4efcf1adb81759dbede8ce17f88e6b63a8f9a8aeeebc252a54a65b2
-
SSDEEP
384:KrxUgV8y88phTy4byzLeReRbn0BJr6OjWD3f8VsWswisr+Ht9mNKPKBnUDnrg:es18phTQi3LbjOP8maiC0fmNKPK+Drg
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2580 regedit.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 1004 69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe 1004 69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1004 wrote to memory of 2580 1004 69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe 82 PID 1004 wrote to memory of 2580 1004 69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe 82 PID 1004 wrote to memory of 2580 1004 69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69bd2376715fb9458a80e7e527832b00_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:2580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166B
MD5f44153ef26be29552cf320325ad8b72e
SHA174ac72ba2ff0f871e59b11c95ad707372662370c
SHA256767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
SHA5121d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
-
Filesize
36KB
MD504dc0697bd8b651005aaae52ded921e4
SHA1baa0902ba21b7e01f75f1e7eb59308cc537d65b8
SHA2563595f5be0db294b499cc348212765a02df40fd02e463344f5e8bbdb2ad58abdd
SHA5126b3d002f12fdbcb6b73d16ff2bab9f19c800668c944702c4d86e55da93194ea0e0e9ea3ba0b1401cf3e03d3832bf74825233e1d40bf108ad08aed13aea6d8755