Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 02:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe
-
Size
132KB
-
MD5
9a43033bae3435e3835d55db273a9e50
-
SHA1
385e437e4fd6ce8ca22d8da387856080428fed12
-
SHA256
b9653c5a24ad99ec882956b8c2e5600819fe72b8b172843c7118568ea1b4332f
-
SHA512
849948337c35288251113fedb1c2961dbb2c83b1129d63cc4a5820e3f8e545dda7d1d28a62309d632e70366397e9fcbd20ba83e8479554dc1435574eec9531f7
-
SSDEEP
3072:DEboFVlGAvwsgbpvYfMTc72L10fPsout6nnnS:ABzsgbpvnTcyOPsoS6nnnS
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2288 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 384 KVEIF.jpg -
Loads dropped DLL 4 IoCs
pid Process 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 2288 svchost.exe 384 KVEIF.jpg 1608 svchost.exe -
resource yara_rule behavioral2/memory/4124-5-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-13-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-11-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-9-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-7-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-29-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-33-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-32-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-31-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-27-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-26-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-23-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-21-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-19-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-17-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-15-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-2-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/4124-3-0x0000000002180000-0x00000000021D5000-memory.dmp upx behavioral2/memory/2288-113-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-131-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-129-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-127-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-125-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-123-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-121-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-119-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-117-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-116-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-111-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-109-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-107-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-105-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx behavioral2/memory/2288-104-0x0000000002EA0000-0x0000000002EF5000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kernel64.dll 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\kernel64.dll 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4124 set thread context of 2288 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 89 PID 384 set thread context of 1608 384 KVEIF.jpg 92 -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\$$.tmp svchost.exe File created C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs1.ini svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFs5.ini KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\web\606C646364636479.tmp 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe File opened for modification C:\Windows\web\606C646364636479.tmp 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 2288 svchost.exe 384 KVEIF.jpg 384 KVEIF.jpg 384 KVEIF.jpg 384 KVEIF.jpg 384 KVEIF.jpg 384 KVEIF.jpg -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2288 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 384 KVEIF.jpg Token: SeDebugPrivilege 384 KVEIF.jpg Token: SeDebugPrivilege 384 KVEIF.jpg Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 2288 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe Token: SeDebugPrivilege 1608 svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4124 wrote to memory of 2784 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 84 PID 4124 wrote to memory of 2784 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 84 PID 4124 wrote to memory of 2784 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 84 PID 4124 wrote to memory of 2288 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 89 PID 4124 wrote to memory of 2288 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 89 PID 4124 wrote to memory of 2288 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 89 PID 4124 wrote to memory of 2288 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 89 PID 4124 wrote to memory of 2288 4124 9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe 89 PID 740 wrote to memory of 384 740 cmd.exe 91 PID 740 wrote to memory of 384 740 cmd.exe 91 PID 740 wrote to memory of 384 740 cmd.exe 91 PID 384 wrote to memory of 1608 384 KVEIF.jpg 92 PID 384 wrote to memory of 1608 384 KVEIF.jpg 92 PID 384 wrote to memory of 1608 384 KVEIF.jpg 92 PID 384 wrote to memory of 1608 384 KVEIF.jpg 92 PID 384 wrote to memory of 1608 384 KVEIF.jpg 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9a43033bae3435e3835d55db273a9e50_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 02⤵PID:2784
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 02⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\system32\cmd.execmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F5658401⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg"C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F5658402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 03⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5e5d21e3bf21de35045605f4aa2e6e6f4
SHA14faf2c51a35dc6f224eb032f311f7fc98ac2e36b
SHA25612c36ba8178e4a475c5800ece2035bf3efb84f5aa6a42833dfbe7080697f8317
SHA5126d8f7ec4b1dd17532df1e15800ef1e3d8560db4f2b8ea3944f1e16ed41ea9aae93c2719a18c53cbc490180436a28412368914ada3ad9d2d4b43556c3e2808086
-
Filesize
22B
MD55c1564c776659e446d55f70de48cb231
SHA14a1e3d5688ae3a02916744326b9eb2d763dd5898
SHA256ecaa67687bb051a078893cab98904cb2b6fa6d2aa51338c4a13d01caa162ec67
SHA5129ee5030c3c50a05cd6c1d67627ca6b0e433c752a701f7e876e4515645ef71ad00dde06d1a9b8a7dc4955225fdde26e4b705b2bd67cd7653bb4f4fea0d8d64cd9
-
Filesize
87B
MD5cfd99fa853846ef06460e215183b5562
SHA102e4aeccdf4daf6c2f213fa1d4a3d849c0d45c75
SHA25674f82e0b3d65feb539a44b6710edd39a13461af7768f24b9b5306991c5907076
SHA51274115a885a203a72391b108872a05985c222db93827b0e11b005bfa641a6a0f1818f7ef06a3cac68eeec8197a0fab1f6d6d93e0590452a7c4bf7b2bc0d000ddf
-
Filesize
132KB
MD588c9061879cc860eaffdb797cddb0559
SHA1a884c0fdd267ec4e7a7bf177e882d47d10e4cc71
SHA256643c675ac3d7b2bfdd4c4c2fce8d0c876393aacb2b414fb3d4a08710d6637b46
SHA512d8a4b16f3ae0a090621b93aa431bf5811bf1e168713ab8c24ee55ac13cf23b197706a4124fa55fe3886ec73eaf6ef8c3721776d0b7faccdf131e6024a97242c6
-
Filesize
132KB
MD51c09712828d78a3d326b77739128a275
SHA1883d699a940201de2437e3dc444837101aed78ad
SHA2569bb504def9612a8b35e92a7ddedf4256262367ab0b527120ff8ff14755886d2e
SHA5129e91e91aadc297110b3851e3f7f0d768caa01fa68ef9c7655ddf7ac461f5b9c01e168b32020cc9eb24f99db9fcd63e51989c0e57ac9be1e6077f7df6b6223f9c
-
Filesize
1KB
MD56d8891b5732faaa330d6852b4942edc7
SHA10f21958f1d31a4d44250d43866a0112f881fd35f
SHA25664e78c7976ae95ba1b255703906e0433b216bd646d47b223c7ce47b96fe47c79
SHA512cfef5f23ff39961abe13393e151e75fccbb8d30d3d55872257dc89d04b6fec5a9e32a7dd26a587a11a27575282988f5c628cfd6b3408c7d61eb6dc0ab2eed3e8
-
Filesize
625KB
MD5eccf28d7e5ccec24119b88edd160f8f4
SHA198509587a3d37a20b56b50fd57f823a1691a034c
SHA256820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
-
Filesize
108KB
MD5f697e0c5c1d34f00d1700d6d549d4811
SHA1f50a99377a7419185fc269bb4d12954ca42b8589
SHA2561eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
SHA512d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202
