32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
Size

832KB
MD5

27c26e28aeb98f5e82fe1e07d8285a50
SHA1

8d6eb25e9e6f4240bb3f0310f5527e9bb82a1caa
SHA256

32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9
SHA512

3ad73bffaddb2a02409c2e62521ef878438ad8a25a2aaa5cd7dedf7cc2d9ae3a899061abba6f70aa28d0717c65b08afa309a6c65f11cefb04da9f23f11024b79
SSDEEP

12288:5UY7147j0npM4dl0v5Jdm5IgVQBHzS+iYf8MWcqxgJj5v37QgzdrIVOmkV0npM4y:5UY7147jEM4dmv5BTqV0EM4dmv51

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4076	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4076	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2340	4504	WerFault.exe	80
3520	4076	WerFault.exe	84
3896	4076	WerFault.exe	84
1576	4076	WerFault.exe	84
4316	4076	WerFault.exe	84
1696	4076	WerFault.exe	84
1392	4076	WerFault.exe	84

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4504	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4076	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4076	4504	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe	84
PID 4504 wrote to memory of 4076	4504	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe	84
PID 4504 wrote to memory of 4076	4504	32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 384
  2⤵
  - Program crash
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 352
    3⤵
    - Program crash
    PID:3520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 744
    3⤵
    - Program crash
    PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 740
    3⤵
    - Program crash
    PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 776
    3⤵
    - Program crash
    PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 812
    3⤵
    - Program crash
    PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 840
    3⤵
    - Program crash
    PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4504 -ip 4504
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4076 -ip 4076
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4076 -ip 4076
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4076 -ip 4076
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4076 -ip 4076
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4076 -ip 4076
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4076 -ip 4076
1⤵
PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\32d152105d5595ce97f663b23dbe7320939c0d3c7b7b99cd4fb877e54ea81ca9_NeikiAnalytics.exe

Filesize
832KB

MD5
11471fe47459b16c736a4f40001a912c

SHA1
e7328e0a493145adf3eddf1b4add909930617ee8

SHA256
670cb2645130d3e1160d635fa158fc00d8b2caa9147024bdd4be199a5aa67cd6

SHA512
265e8191c82cf1ec0a44c890c384209901199564f512c7e71078064f02f879e80b1072aa01039e3ece2e88ecab91a1a7752bc55f7f0b953ab3889f360fdaf93e

Download Submit
memory/4076-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-8-0x00000000001A0000-0x00000000001E1000-memory.dmp

Filesize
260KB

Download
memory/4076-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4504-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download