Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16-06-2024 05:38
General
-
Target
d9b63767590d4a1803da096521fccce0_NeikiAnalytics.exe
-
Size
99KB
-
MD5
d9b63767590d4a1803da096521fccce0
-
SHA1
3b291582a1a4a2e9106cf1f521d585fea977e863
-
SHA256
2f74fbc202004cc839c592fb5257a0fadf323a589d3b2767791fdcb28854b3c5
-
SHA512
171d90654496d16abbd6ec7aacff841520e4119e7dd943895d512f09c6b8d562d1dff32a9f251143a362b5bfa2db94cfb166d89421e46ed4dd2df1b03e3989d6
-
SSDEEP
1536:eshfSWHHNvoLqNwDDGwCe6cLJxtdlmTgja52YN3e0zm:vhfxHNIie6cLJxtdlmTgja52YN3e0zm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9b63767590d4a1803da096521fccce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9b63767590d4a1803da096521fccce0_NeikiAnalytics.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD59adf77f469253c9c0d9d3dc7a3e6a15a
SHA1b6f02a04cc1007b0ed3239162aa95ceb14a2cd8f
SHA256089f2df5a4adf63f2faf14e8c168f9b65563a67ba49876e538a91bf98e69c85e
SHA5129f630b47f63876ee6280219349ffbdc968ef89cce2544f6616b6870c774d7df862e03f86f6f9492ade60251ab6874ef4932dcab07f81ecfd327ac1eb031899d0
-
Filesize
99KB
MD59ceaa8e83f32ac3e9e965febba76b73c
SHA1cd84408b2374025bc574dce856e42364640d932e
SHA256191124ab0eb3dd64b9c3d276df7b7effcbed1cd998ea374681d3ae4aab7a613f
SHA512dab88104b522ba5ff1c0e4fcdbff01e88aad83adb34513cd3f9d63a2f33e22faab78ba87774f6f8896dabec2968a2e0fd241605451318e18fa6775c4bef27694
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB