Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe
-
Size
83KB
-
MD5
5ec8082e9622b2067e3f9758dacc1160
-
SHA1
2b94aee157e3396571d56db1bef6ca380f5aa2dd
-
SHA256
5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9
-
SHA512
d7697f66de9006da500713931eaef56a7cee168c8806eaf6d4aa1265a84a6e1a8cbc60a3ef618a8f2e1a909e91ac07890510b2bd99c64b9afacb6ee67eb38ec7
-
SSDEEP
768:ISyQwBAvUZU9QZU93DMzXNIQ3aH+rMQKAWSJ5vDBNj0gww13dzVZWrVjf/QTd:ISywUzUDMzNpPrfDfLDfjB1/nKh/
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 380 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 3 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 400 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 4 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 436 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 5 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 484 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 6 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 492 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 7 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 500 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 8 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 600 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 9 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 680 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 10 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 748 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 11 PID 1912 wrote to memory of 820 1912 5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe 12
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1168
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:856
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:352
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1068
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1104
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2064
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2068
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:400
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5bffbb0e11703836148d23f1b5a6786bede111c459833d5bd415699fde0b1ab9_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\4104601605\zmstage.exeC:\Users\Admin\AppData\Local\Temp\4104601605\zmstage.exe1⤵PID:2888