5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe
Size

416KB
MD5

1d0efa35f78025a17cddd4a5c47fcd50
SHA1

00d9f33efefd6b011bd40d2cfe95dc2d693e52c0
SHA256

5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220
SHA512

404e88c993d33ff0e0abaf2f8e542c3aff5350947a9eae96efdaea30f6bb2c77fbf74b3d6476594c9bb853fc3602f76db0dd9f3e929b97716f2cf05abf8d7957
SSDEEP

6144:XE+3+8N6LE7ASgT79H0W7cyqCxSngmMBqfycuPbUl0i5cD5J6KE:XZ1AdT7j0npM4dl0v5JdE

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
940	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
940	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3564	1256	WerFault.exe	82
4852	940	WerFault.exe	86
2480	940	WerFault.exe	86
4124	940	WerFault.exe	86
1720	940	WerFault.exe	86
1616	940	WerFault.exe	86
4600	940	WerFault.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1256	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
940	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 940	1256	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe	86
PID 1256 wrote to memory of 940	1256	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe	86
PID 1256 wrote to memory of 940	1256	5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 384
  2⤵
  - Program crash
  PID:3564
- C:\Users\Admin\AppData\Local\Temp\5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 352
    3⤵
    - Program crash
    PID:4852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 740
    3⤵
    - Program crash
    PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 788
    3⤵
    - Program crash
    PID:4124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 772
    3⤵
    - Program crash
    PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 776
    3⤵
    - Program crash
    PID:1616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 552
    3⤵
    - Program crash
    PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1256 -ip 1256
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 940 -ip 940
1⤵
PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 940 -ip 940
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 940 -ip 940
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 940 -ip 940
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 940 -ip 940
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 940 -ip 940
1⤵
PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5defb703ce3d44970eacc21fe1e4159f5d55e1e3ea15330de09337d83e9bb220_NeikiAnalytics.exe

Filesize
416KB

MD5
3d6eea0f14ddf683bf2f340c274d3227

SHA1
86e605f0d49371e5da4303bf3f1ca44aacc2066c

SHA256
cc224f52289dd68bec97836fff81588c278b6505620cac8ac1e123bf64e01026

SHA512
155f5a120aac4964ddebbf8cab673df01e911b5c7a5c62e728b37a3ea3fcc6ef2e2e75c46a4b8cdeb86790ba7dc30c2fe60016ddb76e21adefca547619860b8a

Download Submit
memory/940-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/940-8-0x0000000004DA0000-0x0000000004DE1000-memory.dmp

Filesize
260KB

Download
memory/940-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1256-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1256-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download