Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 23:07
Static task
static1
Behavioral task
behavioral1
Sample
0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe
-
Size
44KB
-
MD5
0db543eb6303a474b1011164df96a480
-
SHA1
40eec54c64cf443e00c4b93ce20516f62e94faf1
-
SHA256
9ecd6945095a31341e55bf45ebbec061714a9cdbdb4dac3478b1d673458a67df
-
SHA512
1f2fc42ec2723836f1d21e8b8f0b3437889b3194ee4c9f26cd9f373fd7a520f2164b6dfcb5601f003ca48f0421c2ca1e98c18debb7edbaf4b4bfe14227b59ff8
-
SSDEEP
768:F3u9+vWm9aIbisNVEK2c28bpM2dBOsRxIVSJRwBlc:Fe9matCeUHUVSJRG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\A58ED56C = "C:\\Users\\Admin\\AppData\\Roaming\\A58ED56C\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
winver.exepid process 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe 3020 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 3020 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
0db543eb6303a474b1011164df96a480_NeikiAnalytics.exewinver.exedescription pid process target process PID 2132 wrote to memory of 3020 2132 0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe winver.exe PID 2132 wrote to memory of 3020 2132 0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe winver.exe PID 2132 wrote to memory of 3020 2132 0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe winver.exe PID 2132 wrote to memory of 3020 2132 0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe winver.exe PID 2132 wrote to memory of 3020 2132 0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe winver.exe PID 3020 wrote to memory of 1204 3020 winver.exe Explorer.EXE PID 3020 wrote to memory of 1096 3020 winver.exe taskhost.exe PID 3020 wrote to memory of 1160 3020 winver.exe Dwm.exe PID 3020 wrote to memory of 1204 3020 winver.exe Explorer.EXE PID 3020 wrote to memory of 2132 3020 winver.exe 0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0db543eb6303a474b1011164df96a480_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-27-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/1160-20-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB
-
memory/1160-25-0x00000000772B1000-0x00000000772B2000-memory.dmpFilesize
4KB
-
memory/1160-24-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB
-
memory/1204-6-0x00000000020B0000-0x00000000020B6000-memory.dmpFilesize
24KB
-
memory/1204-22-0x00000000020C0000-0x00000000020C6000-memory.dmpFilesize
24KB
-
memory/1204-13-0x00000000772B1000-0x00000000772B2000-memory.dmpFilesize
4KB
-
memory/1204-28-0x00000000020C0000-0x00000000020C6000-memory.dmpFilesize
24KB
-
memory/1204-3-0x00000000020B0000-0x00000000020B6000-memory.dmpFilesize
24KB
-
memory/1204-2-0x00000000020B0000-0x00000000020B6000-memory.dmpFilesize
24KB
-
memory/2132-7-0x0000000002290000-0x0000000002C90000-memory.dmpFilesize
10.0MB
-
memory/2132-1-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2132-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2132-26-0x0000000002290000-0x0000000002C90000-memory.dmpFilesize
10.0MB
-
memory/3020-12-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/3020-8-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/3020-9-0x0000000077460000-0x0000000077461000-memory.dmpFilesize
4KB
-
memory/3020-10-0x000000007745F000-0x0000000077460000-memory.dmpFilesize
4KB
-
memory/3020-4-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/3020-11-0x000000007745F000-0x0000000077461000-memory.dmpFilesize
8KB
-
memory/3020-14-0x0000000077260000-0x0000000077409000-memory.dmpFilesize
1.7MB
-
memory/3020-33-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB