2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe

Analysis

max time kernel
146s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe
Size

384KB
MD5

88bc45c910bb6ea8f09db5e7b1e4e1f0
SHA1

229f994212264b91dc5e4edbe3ef615d342acbab
SHA256

2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe
SHA512

c38865cb5ca94b9ace850ed56553c7aa11862e7b4cecf6d1345f03ef35dbaeced1f34088e0b08f522894ea6cc45bac27bc3807d69492dae65537775efd0e7513
SSDEEP

6144:FW+fbNzV3u7kCmbPXkn0LGOPh6jTFRbf0eN0W7cyqCxSngmMBqfycuPbUl0i5cDj:F1F7jUyGgh6XFRbf0ez0npM4dl0v5Jz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3572	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3572	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2968	1420	WerFault.exe	80
1504	3572	WerFault.exe	84
2408	3572	WerFault.exe	84
520	3572	WerFault.exe	84
2388	3572	WerFault.exe	84
388	3572	WerFault.exe	84
412	3572	WerFault.exe	84

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1420	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3572	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3572	1420	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe	84
PID 1420 wrote to memory of 3572	1420	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe	84
PID 1420 wrote to memory of 3572	1420	2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 384
  2⤵
  - Program crash
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 360
    3⤵
    - Program crash
    PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 768
    3⤵
    - Program crash
    PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 788
    3⤵
    - Program crash
    PID:520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 776
    3⤵
    - Program crash
    PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 796
    3⤵
    - Program crash
    PID:388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 808
    3⤵
    - Program crash
    PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3572 -ip 3572
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3572 -ip 3572
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3572 -ip 3572
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3572 -ip 3572
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3572 -ip 3572
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3572 -ip 3572
1⤵
PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2e72126bc57c825479b605f5a70451a72ae8a09d1b9fce9d1f709b8aa1c30bbe_NeikiAnalytics.exe

Filesize
384KB

MD5
b0bb68486b17062fc5b987746dab559a

SHA1
6dc87c148ce6701f2f2bd1fe2e1ceb9abee7715e

SHA256
ae2bb73df0d293c7c35e4fdf628dc67e1c6bdc9b8fa4815db1bec77482aa4f53

SHA512
d39ad0abde5c8edad07b40717f992588b7694c325f280092cfc5bafc93fbcb43eaf204319e8bc4126801b86b7e61f1c16887be5d67d1ae1dcc9bd6f3b4142ae9

Download Submit
memory/1420-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1420-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3572-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3572-8-0x00000000014A0000-0x00000000014E0000-memory.dmp

Filesize
256KB

Download
memory/3572-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download