Overview

overview

7

Static

static

3

32d152105d...cs.exe

windows7-x64

7

32d152105d...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    27/06/2024, 22:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe

  • Size

    832KB

  • MD5

    27c26e28aeb98f5e82fe1e07d8285a50

  • SHA1

    8d6eb25e9e6f4240bb3f0310f5527e9bb82a1caa

  • SHA256

    32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9

  • SHA512

    3ad73bffaddb2a02409c2e62521ef878438ad8a25a2aaa5cd7dedf7cc2d9ae3a899061abba6f70aa28d0717c65b08afa309a6c65f11cefb04da9f23f11024b79

  • SSDEEP

    12288:5UY7147j0npM4dl0v5Jdm5IgVQBHzS+iYf8MWcqxgJj5v37QgzdrIVOmkV0npM4y:5UY7147jEM4dmv5BTqV0EM4dmv51

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:2760

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
          Filesize

          832KB

          MD5

          db56dc30bc532a624ff907ad7bf12da8

          SHA1

          b2733f5740e1d4e40e044c5903560888a8d97a88

          SHA256

          ba72fc5926c0e59cbb97a0dbeca84b39b3d9091f855322e548eeecc3d477707d

          SHA512

          db97d48e45e61271965d7484e172d9afdd62c3b3bf4d01e28f47cfff3b832d7d1cf9ffb5fa9c527351daba981f342ac9d58befba10f90bc4ff4d06472ec5c1a9

          Download Submit

        • memory/2760-11-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2760-12-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        • memory/2760-17-0x0000000002B70000-0x0000000002BB1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3064-0-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3064-6-0x0000000002C70000-0x0000000002CB1000-memory.dmp

          Filesize

          260KB

          Download

        • memory/3064-10-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download