Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
-
Size
66KB
-
MD5
70614727b708b0fb1600cea9e9c82180
-
SHA1
e9a9a8f2a9103f25ac1bbf92d1549f10b6e3f986
-
SHA256
0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17
-
SHA512
cfada771036d7cae22397c78a21a5c8a1e05b51ba7cfe1ada7625d01b53d7b7fff501f34245b4b26b759b99db27dc54ecb96b487d0235b8b6fcb7dd6ff39600c
-
SSDEEP
768:iLxqBt1sJw5pVNUP1/kvtbWcpmCKXfak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKpH:1teqYQIXJJyXEv/MBK6vRel1Gwl
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2004 irpoxoadú±¬± 3192 irpoxoadú±¬± -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\irpoxoadú±¬± 0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe File created C:\Windows\SysWOW64\irpoxoadú±¬± 0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\usnoapifú°¸¸ irpoxoadú±¬± File created C:\Windows\SysWOW64\usnoapifú°¸¸ irpoxoadú±¬± File opened for modification C:\Windows\SysWOW64\irpoxoadú±¬± irpoxoadú±¬± -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 3192 irpoxoadú±¬± 3192 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± 2004 irpoxoadú±¬± -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3912 wrote to memory of 2004 3912 0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe 80 PID 3912 wrote to memory of 2004 3912 0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe 80 PID 3912 wrote to memory of 2004 3912 0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe 80 PID 2004 wrote to memory of 3192 2004 irpoxoadú±¬± 81 PID 2004 wrote to memory of 3192 2004 irpoxoadú±¬± 81 PID 2004 wrote to memory of 3192 2004 irpoxoadú±¬± 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\irpoxoadú±¬±"C:\Windows\system32\irpoxoadú±¬±"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\irpoxoadú±¬±--k33p3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD570614727b708b0fb1600cea9e9c82180
SHA1e9a9a8f2a9103f25ac1bbf92d1549f10b6e3f986
SHA2560d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17
SHA512cfada771036d7cae22397c78a21a5c8a1e05b51ba7cfe1ada7625d01b53d7b7fff501f34245b4b26b759b99db27dc54ecb96b487d0235b8b6fcb7dd6ff39600c
-
Filesize
5KB
MD548c45e05569f9a5665d082fbdc116c14
SHA1e491ab1327b88312fc6d0535621b6de733c8efb5
SHA2567e916f847bb5de3e09b36bd527e09ed656df13296bdcd9924185bcccde7dbe4c
SHA512e1cc47e185831dc6c40372efc227f299964f262c641b790d31f0fe452a5bc70a4946c689913504c64790833c131d40c01fcd9ff3a148636be9f502959f7cc49c