Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 22:50
Static task
static1
Behavioral task
behavioral1
Sample
0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe
-
Size
38KB
-
MD5
02c357876063c3950c69c091e1de2e80
-
SHA1
67acdefe6147b588c02998b36fc898070f36a079
-
SHA256
0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a
-
SHA512
15fb13843a8a65f7d4794757a454fac2dfeb8579a66ad4e68b3bc57196977c57aeefd6c9cb753391f477c6064f8f056b2bf6a23f837ff9dd7137c150f6d899ac
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhy:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYS
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2864 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2864 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2864 2296 0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe 28 PID 2296 wrote to memory of 2864 2296 0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe 28 PID 2296 wrote to memory of 2864 2296 0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe 28 PID 2296 wrote to memory of 2864 2296 0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d3aa1236d31c738c29f0213693d4d268df20659c691ef5c8246b4dc4da3457a_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:2864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD55f96ccd63dd610144dee811d3413f0d0
SHA118e04149d74301eaceadb4d7186b904f1edb12ff
SHA2560f080d39e9792079eb620f127c90d3377e1f75150a2e86f3f1ddd000508a3721
SHA512c0e59d0c494cd71819767dffebe1b5d8d8cc4d1d139b62f4ba398ab0a867cd0d81b2c1c2acbd8d58054f7b3f27a358cb514de8268062a49eb7b0726dee14e4ba