Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe
-
Size
7.0MB
-
MD5
bb555f5c6253a0103ec7377f9651e550
-
SHA1
185b1be197b6afb53240d9487a2d9f235d06c5f2
-
SHA256
53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a
-
SHA512
ebb963b0c995c3d023839226de2d23e90d1870f9be46ca3e9d22b82e08816ca35d6dacd22922c3d0505eadf2218fda28bda9a20c2e441ee5640d521f47d1033b
-
SSDEEP
98304:emhd1UryewT/Or7s8QV7wQqZUha5jtSyZIUbn:elQTWs2QbaZtliK
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 108 193B.tmp -
Executes dropped EXE 1 IoCs
pid Process 108 193B.tmp -
Loads dropped DLL 2 IoCs
pid Process 2872 53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe 2872 53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 108 2872 53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe 28 PID 2872 wrote to memory of 108 2872 53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe 28 PID 2872 wrote to memory of 108 2872 53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe 28 PID 2872 wrote to memory of 108 2872 53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\53832e6394dbccee5cd0c7582e3766094827d14b093360a238db35f372542d0a_NeikiAnalytics.exe 08A768EED002C249AED4E602785E5639366D7F4145C5C5A28AC7730B61CD423F2F3A018EA1B9BA9E885D1199C26634EA63225F6D87120FEBF68E33C1E986C7812⤵
- Deletes itself
- Executes dropped EXE
PID:108
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.0MB
MD5b025a6d80cd5dac43ffe22ad6ab45043
SHA16f2d65d8a8905deba6990de2adc4a555fd45e2d1
SHA2568101253c8f9dff0594123aae83dd18ce2e7abcaeba4bcdff189b77d92bf2f53a
SHA51246e0e0bd1621fcc1c94d93ce3a4b5fb77aa873cd277b012faa1af6eb8a3939e45bdb9788ca295e43ecd3e1f17355787f0b6b21e62b13ca4cc39a8d7ef89bcb98