Analysis
- max time kernel
150s - max time network
148s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
15/06/2024, 23:58
General
- Target c44c823252cd01e0b751855b657c9a40_NeikiAnalytics.exe
- Size 41KB
- Sample240615-31hcsszhjb
- SHA256 f17a32300156d5d996faf187cc4de9f408e12397dd3fb3ef3dadfd114cfbb732
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c44c823252cd01e0b751855b657c9a40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c44c823252cd01e0b751855b657c9a40_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
services.exe
memory/376-2-0x0000000000500000-0x0000000000510200-memory.dmp
memory/376-9-0x0000000000220000-0x0000000000228000-memory.dmp
memory/376-67-0x0000000000500000-0x0000000000510200-memory.dmp
memory/376-10-0x0000000000220000-0x0000000000228000-memory.dmp
memory/376-17-0x0000000000500000-0x0000000000510200-memory.dmp
memory/376-65-0x0000000000500000-0x0000000000510200-memory.dmp
memory/376-60-0x0000000000500000-0x0000000000510200-memory.dmp
memory/376-24-0x0000000000220000-0x0000000000228000-memory.dmp
memory/376-25-0x0000000000220000-0x0000000000228000-memory.dmp
memory/376-53-0x0000000000500000-0x0000000000510200-memory.dmp
memory/2076-32-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-56-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-42-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-44-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-49-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-30-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-54-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-37-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-23-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-61-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-66-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-18-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-11-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-68-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2076-73-0x0000000000400000-0x0000000000408000-memory.dmp