75cd1b21fd6d69568ac2a776f78ae099ecd8a77d92812a8e93d539a7cd343ac5

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe
Size 916KB
Sample240613-ns8gpaxbla
SHA256 75cd1b21fd6d69568ac2a776f78ae099ecd8a77d92812a8e93d539a7cd343ac5
MD5 78fcc9368d40db8372aefc14ebaf86d0
SHA1 b82af20cb8d98d9f482e29e4be5e67d0a7af26c8
SHA512 4188c3aacf80f1bb735f71a3725a01f2c9171da7a513b9864a99354387d45c2226879be5a84deeea95e77af1716d3b3e73ff1e19a2e9d3d3c3aac47ad914b42a
SSDEEP 6144:SH6KLeLZifU+xdDPCvR6MA2fy6NahcPoGAjsHZrwABrxxJa/YES:3yo+xRK4Mjy6QKQGYorjlDa/ZS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3444	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3444	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2488	4056	WerFault.exe	88
3012	3444	WerFault.exe	96
4552	3444	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4056	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3444	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3444	4056	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe	96
PID 4056 wrote to memory of 3444	4056	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe	96
PID 4056 wrote to memory of 3444	4056	78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 344
  2⤵
  - Program crash
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 352
    3⤵
    - Program crash
    PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 388
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4056 -ip 4056
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3444 -ip 3444
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3444 -ip 3444
1⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1276,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
1⤵
PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe

Path C:\Users\Admin\AppData\Local\Temp\78fcc9368d40db8372aefc14ebaf86d0_NeikiAnalytics.exe
Size 916KB
SHA256 e9f5abe76f56305a0afe9387599f8c3acfdd014a5d0d16c0b1e82ef5dafe1cd7
MD5 2f1909e61557c5d36ca136876691c5e5
SHA1 770c3443b2262234485e6bf716d71f2e187884a0
SHA512 53ce9b7e6a04667ded03a2889f15b9141fb32088422de4ac983b53948d49f8adb15a2fcf876072a10f214a01ffbd7cbbe3f6c6b25a5c8215c3cf1aca3d6543a7
SSDEEP 12288:R2tH2fLpfOJeQKI5te1nmC+L8LYjlDa/ZS:R2N2zNwr8Lea/ZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3444-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/3444-9-0x00000000050A0000-0x0000000005185000-memory.dmp

Download

memory/3444-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4056-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/4056-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads