Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 02:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe
-
Size
132KB
-
MD5
9a43033bae3435e3835d55db273a9e50
-
SHA1
385e437e4fd6ce8ca22d8da387856080428fed12
-
SHA256
b9653c5a24ad99ec882956b8c2e5600819fe72b8b172843c7118568ea1b4332f
-
SHA512
849948337c35288251113fedb1c2961dbb2c83b1129d63cc4a5820e3f8e545dda7d1d28a62309d632e70366397e9fcbd20ba83e8479554dc1435574eec9531f7
-
SSDEEP
3072:DEboFVlGAvwsgbpvYfMTc72L10fPsout6nnnS:ABzsgbpvnTcyOPsoS6nnnS
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2424 dllhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1864 KVEIF.jpg -
Loads dropped DLL 4 IoCs
pid Process 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 2424 dllhost.exe 1864 KVEIF.jpg 2332 svchost.exe -
resource yara_rule behavioral1/memory/1508-3-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-2-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-5-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-13-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-11-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-9-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-7-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-15-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-20-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-27-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-25-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-23-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-21-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-17-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-33-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-32-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-31-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/1508-30-0x0000000001C50000-0x0000000001CA5000-memory.dmp upx behavioral1/memory/2424-86-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-88-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-100-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-98-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-96-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-94-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-92-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-90-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-84-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-82-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-80-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-78-0x0000000000140000-0x0000000000195000-memory.dmp upx behavioral1/memory/2424-77-0x0000000000140000-0x0000000000195000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kernel64.dll 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\kernel64.dll 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1508 set thread context of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1864 set thread context of 2332 1864 KVEIF.jpg 31 -
Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini dllhost.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg dllhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini dllhost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD dllhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD dllhost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp dllhost.exe File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg dllhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg dllhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA dllhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\web\606C646364636479.tmp 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Windows\web\606C646364636479.tmp 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1864 KVEIF.jpg -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 1864 KVEIF.jpg 1864 KVEIF.jpg 1864 KVEIF.jpg 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2424 dllhost.exe 2332 svchost.exe 2424 dllhost.exe 2332 svchost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2424 dllhost.exe 2332 svchost.exe 2424 dllhost.exe 2332 svchost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2424 dllhost.exe 2332 svchost.exe 2332 svchost.exe 2332 svchost.exe 2424 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2424 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 1864 KVEIF.jpg Token: SeDebugPrivilege 1864 KVEIF.jpg Token: SeDebugPrivilege 1864 KVEIF.jpg Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2424 dllhost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2424 dllhost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2424 1508 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 1864 1888 cmd.exe 30 PID 1888 wrote to memory of 1864 1888 cmd.exe 30 PID 1888 wrote to memory of 1864 1888 cmd.exe 30 PID 1888 wrote to memory of 1864 1888 cmd.exe 30 PID 1864 wrote to memory of 2332 1864 KVEIF.jpg 31 PID 1864 wrote to memory of 2332 1864 KVEIF.jpg 31 PID 1864 wrote to memory of 2332 1864 KVEIF.jpg 31 PID 1864 wrote to memory of 2332 1864 KVEIF.jpg 31 PID 1864 wrote to memory of 2332 1864 KVEIF.jpg 31 PID 1864 wrote to memory of 2332 1864 KVEIF.jpg 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\dllhost.exeC:\Windows\System32\dllhost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 02⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\system32\cmd.execmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F5658401⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F5658402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 03⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD58a10e598f77c49df3d51e7a1e4261a5a
SHA14c7cfbde077b8037e361c37cf2b40b899ff6ab5e
SHA256a057db031e91ec57c7b0b703fbcd9bdfe3d215d1d54070fa756733d5c63e270e
SHA51289ddff02302bf1821799c8619922167298990e1671bb3eca830297bff5a0f1eabf590939b56fe17e5da311d18972229605b7e7552e6e3f77a3e03dae48763774
-
Filesize
108KB
MD5f697e0c5c1d34f00d1700d6d549d4811
SHA1f50a99377a7419185fc269bb4d12954ca42b8589
SHA2561eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202
-
Filesize
132KB
MD50a2eaa5a3528abf5aba68fb072467509
SHA1e61078e6f0204f0f35f0f055219c9676372f1174
SHA256647de7121dd1e8f27a0015f9dc39b8df786e24ad1244253dcf9dee76416ce25b
SHA512ca7c0bc3d2d4ed51892f3a9767ea50677b6944552190c248e6a2a84cdcb71bb2345647d82ffd177cb1ce4dece0c90f8e25e44ab0e986bc7d21b852f9a3892d9b
-
Filesize
711B
MD50d9c6664a435fc665462390ec9f908fc
SHA1dc9fcf54679f5bd90428e01d4cbfa94047c5d229
SHA256a085d02137747c5eb0764a12574766933b0a2810cc9625f16a53da6c7e86a756
SHA512ac490c6ddc8c45f975c730736f28f571ae770459ef90b26017cc9ad1e1443dad09a18e40929d8c0cab7b23f145f063d956b8732e8f6b96ebfc4541bcebf69c32
-
Filesize
22B
MD55c1564c776659e446d55f70de48cb231
SHA14a1e3d5688ae3a02916744326b9eb2d763dd5898
SHA256ecaa67687bb051a078893cab98904cb2b6fa6d2aa51338c4a13d01caa162ec67
SHA5129ee5030c3c50a05cd6c1d67627ca6b0e433c752a701f7e876e4515645ef71ad00dde06d1a9b8a7dc4955225fdde26e4b705b2bd67cd7653bb4f4fea0d8d64cd9
-
Filesize
87B
MD5cfd99fa853846ef06460e215183b5562
SHA102e4aeccdf4daf6c2f213fa1d4a3d849c0d45c75
SHA25674f82e0b3d65feb539a44b6710edd39a13461af7768f24b9b5306991c5907076
SHA51274115a885a203a72391b108872a05985c222db93827b0e11b005bfa641a6a0f1818f7ef06a3cac68eeec8197a0fab1f6d6d93e0590452a7c4bf7b2bc0d000ddf
-
Filesize
132KB
MD52e66ed24fc8857b8e98f91bd0b8a8138
SHA101dfc80c3edc846229b20b5496e7399d67145900
SHA256342728dafcb9843254d658fc66a675045798a974bce164b08f5c858d36205d62
SHA51249aeacf80213413d2e7caa1eaa1c6d3fefb70cf73733ae9cf70db2c72d9f3a973c92a325ca877bacb8a6cd429c753534482be35d9ff77bc6dc553647f944b9a0
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94
