0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe
Size

1.1MB
MD5

aec83bac56d8bf46255cf38711c76060
SHA1

5d16396299008d6ca5678a9e45d02c2be9e4fe63
SHA256

0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0
SHA512

4f8abb856800ac601987f472f4e15e422548ea539dc5565cc970adc00b45be90c9931753d44863b3886b92a67f96e05773924e2d4f806f66992cdc81f6665f2b
SSDEEP

24576:a9RnY5OyuHZpszoiLWoWLj/wF5O3X9mJLpa/ZS/Ix77Lv+f6T8Qns7:0nIcHZp0tWEkn9QLpgoIxbq7

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3064	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Loads dropped DLL 1 IoCs

pid	Process
2832	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	pastebin.com
4	pastebin.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3064	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2832	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3064	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3064	2832	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe	29
PID 2832 wrote to memory of 3064	2832	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe	29
PID 2832 wrote to memory of 3064	2832	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe	29
PID 2832 wrote to memory of 3064	2832	0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\0d66496084d3548b4f46084e8fe7edeb3ca5581c7d5e2be04526fe0faea9ddd0_NeikiAnalytics.exe

Filesize
1.1MB

MD5
7219cc5eb22685e7e2255fb1df16b191

SHA1
5b4b4b8cab1d30f19da7cb6815b8fa4c49909734

SHA256
379d48497166e0001c0844ee3af34c669fd5c15df67a56ab418da52e177a4529

SHA512
009d8b9788f61dd11d4955f64d7e12311a4257d6964fb656846dbe260bdba76d9f8046533446138a8edfb2c7142ccf4ef181088dddd1550fb6ade25b1b64eaf2

Download Submit
memory/2832-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2832-8-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2832-7-0x0000000003040000-0x000000000312F000-memory.dmp

Filesize
956KB

Download
memory/3064-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3064-11-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3064-17-0x0000000002E60000-0x0000000002F4F000-memory.dmp

Filesize
956KB

Download
memory/3064-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3064-39-0x000000000ED50000-0x000000000EDF3000-memory.dmp

Filesize
652KB

Download