Analysis
-
max time kernel
136s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe
-
Size
78KB
-
MD5
ed163eb070ea6164b8e031abbd789890
-
SHA1
282b79d312c7d613ef5c93a98506949a7977f032
-
SHA256
65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f
-
SHA512
50c6cd679b2a2cc68802d8bc1dca17d713372046387ff717b0396130ab4b91ddc150f63ccf8023ed09d633e02e118a2b97c0eddd4215b5a45a500e99062ed6bd
-
SSDEEP
768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOnCru/fG:71Tzy48untU8fOMEI3jyYfPiuODG
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3504 wrote to memory of 612 3504 65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe 91 PID 3504 wrote to memory of 612 3504 65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe 91 PID 3504 wrote to memory of 612 3504 65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe 91 PID 612 wrote to memory of 4388 612 cmd.exe 92 PID 612 wrote to memory of 4388 612 cmd.exe 92 PID 612 wrote to memory of 4388 612 cmd.exe 92 PID 4388 wrote to memory of 5092 4388 iexpress.exe 93 PID 4388 wrote to memory of 5092 4388 iexpress.exe 93 PID 4388 wrote to memory of 5092 4388 iexpress.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F31A.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\65efc8f7ba19a5571dc38dbe90e54a5488ee97f4d119cc7bb0a7e788c286ed7f_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:5092
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,3833046924978547022,12404847742964713612,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:81⤵PID:4100
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
78KB
MD53684f9247862524c85d60db6149573bb
SHA1118784e3de2ba300ef7c5c2db8089c3b538d4391
SHA25650bf232d848c39bee409a455c6c75851c3abfcca6a0a601b545cd717deaa9d08
SHA5124e91e519680f2b3123408ffc3ed8b185eba0ff44e87f18ec20724eae9e9a2f85cf810c5b4a52b1a704255c299a91ccc590d8f16a0654a8f1b60756db5fb1e9e3
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083