Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 01:02

General

  • Target

    957ff1d3134c41958de1abbdd2bdcd00_NeikiAnalytics.exe

  • Size

    4.4MB

  • MD5

    957ff1d3134c41958de1abbdd2bdcd00

  • SHA1

    e7d0e96db1c0afc9688b8690fb45558ca422bbf9

  • SHA256

    3c7045392623b0c3e59214eeb765f9b8f903d3dcd1662e865ff1afe67714e725

  • SHA512

    e1ce263b08e729d234f3bf10e1a45546bb36442f74a32bd1902dc20fe18537452622e9dba6dfcc270eec065ed6bc9de97f1895779f417de88421fdcc9b5d8c8b

  • SSDEEP

    98304:emhd1UryeeT2+fqXZCSV7wQqZUha5jtSn:elKfKZ/2QbaZte

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\957ff1d3134c41958de1abbdd2bdcd00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\957ff1d3134c41958de1abbdd2bdcd00_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\3875.tmp
      "C:\Users\Admin\AppData\Local\Temp\3875.tmp" --splashC:\Users\Admin\AppData\Local\Temp\957ff1d3134c41958de1abbdd2bdcd00_NeikiAnalytics.exe 8D6178E600E88BE418EE37A2B785583042347FCB45BE59D1D1A09C8F2C608AF2421F2FB447E45EC90F9ED6288DA32CF344232E912CBCCEFFF4F01A598A7EF3B7
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2536

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3875.tmp

          Filesize

          4.4MB

          MD5

          44526fd6d204fefdbe9c568e76185f29

          SHA1

          7de3b62778d0ee332c12c1e058baf55e001b5176

          SHA256

          fe64e66b0f25b646f1bab3802d9e18e9da42a7b54a610f9115ff54681f38c055

          SHA512

          c4bcbe884334eba4e94f2f65d8c38de1341d4c8e1a750c27384a8f32d9e12a07debb57b04ef825ad3bf4dad4aa72c9dab9c43dc59f1b7b72d25f05854d44f193

        • memory/548-0-0x0000000000400000-0x0000000000849000-memory.dmp

          Filesize

          4.3MB

        • memory/2536-5-0x0000000000400000-0x0000000000849000-memory.dmp

          Filesize

          4.3MB