Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 23:34
Behavioral task
behavioral1
Sample
246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
-
Size
59KB
-
MD5
f93578bd6bebe2b5f8825db989cca1a0
-
SHA1
dd1f0779ad4af9a5847d3b55a94803bab73d8788
-
SHA256
246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538
-
SHA512
a6e9c65ea4d3056b988a43bbf125edc7e32172d5ded1a8c0ab3ee9ede4547f8d3e16ae70c42b40f04bea66a8a9cfc4b6ba04735192dab0a04ee43d9ae6131448
-
SSDEEP
768:HZgO6moL8ifXzCknHwgHbH84J7bPBLszy2Y/nnXvvJ1GS7jc0uWEJ8/r+j58GQ:5gODivrnHFvJ71aMfBR7LEJ8w5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3888 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 3888 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/2120-0-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral2/files/0x0005000000022f58-11.dat upx behavioral2/memory/3888-13-0x0000000000400000-0x000000000043D000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2120 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2120 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe 3888 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2120 wrote to memory of 3888 2120 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe 86 PID 2120 wrote to memory of 3888 2120 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe 86 PID 2120 wrote to memory of 3888 2120 246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3888
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
Filesize59KB
MD5a54d67a6f6f8a07d0905aefd386ab246
SHA1a6e2b2fce4925fccf51fe78efc0fc245beb13621
SHA25638c36f75c39964e9e186cedcd8a311aadcd054d858f385c0b2bcaeac55106317
SHA512b1e150b4d8deffbb625f7f5600e0330ed42213c35474c267e6015e2ed8e4aa4a97496591ac01121a81be1779a17ad0d68f72443ceefb3f780ed6c4d5636f230f