Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 07:10
Behavioral task
behavioral1
Sample
4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe
-
Size
5.9MB
-
MD5
131e631a267e80145e2384d6b8eabc70
-
SHA1
b27dcd4a94bff7ab8e75c1088d71e4fbf64a3315
-
SHA256
4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51
-
SHA512
7e44f79123e18c05c8fd675364cfd4a430eedaaeddd6c810d875e369f9d6b45cfed405dc30a2e62c56829c99b4c1b8c7228ebb93f043232bcd52085b8ae431f5
-
SSDEEP
98304:v4+nhjEEi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFa9hOkrEsUna:vrnbDOYjJlpZstQoS9Hf12VKXFbOCW6
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exepid process 2260 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI14082\python310.dll upx behavioral1/memory/2260-23-0x000007FEF5880000-0x000007FEF5CE5000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exedescription pid process target process PID 1408 wrote to memory of 2260 1408 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe PID 1408 wrote to memory of 2260 1408 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe PID 1408 wrote to memory of 2260 1408 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe 4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4bc27159c93d66241f0ffa22ab5cfd2ec13df3eaaa2950927b0bf0dad3e42f51_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
PID:2260
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI14082\python310.dllFilesize
1.4MB
MD5b93eda8cc111a5bde906505224b717c3
SHA15f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba
-
memory/2260-23-0x000007FEF5880000-0x000007FEF5CE5000-memory.dmpFilesize
4.4MB