Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-06-2024 13:45
Static task
static1
Behavioral task
behavioral1
Sample
4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe
-
Size
368KB
-
MD5
4caaa6c1869be807f91234dfd870f5a0
-
SHA1
a98ccba941c19ae343a7fdbd5e9b195704b08254
-
SHA256
76273b76bedb971c2f72d425ef3bd1e5e1f310515541ba244865809fb284a5dd
-
SHA512
90029be2af0f42acd0c8e94bf223c30c78df5faca4db7c18c423f85e2f86d50b10ab1302920dd283b2181d46d93f9c401a3c9e9f646b1b61e0800b68a1376437
-
SSDEEP
6144:8chnQy0QxstRopSFO716QdkBK9nqbdnW2rIOu4TT:Dhn+QxPD78qkBfV//
Malware Config
Extracted
gcleaner
185.172.128.90
5.42.64.56
185.172.128.69
Signatures
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2008 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exepid process 2184 4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2664 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2664 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.execmd.exedescription pid process target process PID 2184 wrote to memory of 2008 2184 4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe cmd.exe PID 2184 wrote to memory of 2008 2184 4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe cmd.exe PID 2184 wrote to memory of 2008 2184 4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe cmd.exe PID 2184 wrote to memory of 2008 2184 4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe cmd.exe PID 2008 wrote to memory of 2664 2008 cmd.exe taskkill.exe PID 2008 wrote to memory of 2664 2008 cmd.exe taskkill.exe PID 2008 wrote to memory of 2664 2008 cmd.exe taskkill.exe PID 2008 wrote to memory of 2664 2008 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4caaa6c1869be807f91234dfd870f5a0_NeikiAnalytics.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\advdlc[1].htmFilesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
-
\Users\Admin\AppData\Local\Temp\vSPAGOVY\Y-Cleaner.exeFilesize
1.2MB
MD50151e006443174af2f2ea167eb3317fe
SHA14867584b2bb6a5d5b9082a5a1b5d2d571eed7ce2
SHA256af722c86835a47bbb5913361b0cedd00288aa23edd04709460902e4cc04be497
SHA512f8ab571eece442e2c50574420165cb5beeeced3d8561b645c7f771fd28d499fb77bede7c49be1777ee6edf57f86efb6f43614415aa69837cfc1620cca9211d7b
-
memory/2184-5-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2184-1-0x00000000008D0000-0x00000000009D0000-memory.dmpFilesize
1024KB
-
memory/2184-9-0x0000000010000000-0x000000001001C000-memory.dmpFilesize
112KB
-
memory/2184-2-0x0000000000220000-0x000000000025C000-memory.dmpFilesize
240KB
-
memory/2184-16-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2184-21-0x00000000008D0000-0x00000000009D0000-memory.dmpFilesize
1024KB
-
memory/2184-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2184-3-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2184-36-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2184-35-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2184-37-0x00000000008D0000-0x00000000009D0000-memory.dmpFilesize
1024KB