Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 04:29
Static task
static1
Behavioral task
behavioral1
Sample
a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
a244a3b64b61f329489bb5d283bda840
-
SHA1
30cdd35ea5e3eeb0502a641bef81b9db71762230
-
SHA256
0f8d2648166184bde6562f33b7e4b620313fe7a21746720d37594213fba7a604
-
SHA512
293fa4bd0a3b86552d25ca864b0e5f6abb9c43e5d64bea5b694197ba375d74edeb0c27215fd4939dbf04d9b0805d8d7d2cf80f822539bc3772be3becd9c0c417
-
SSDEEP
12288:cpKrcz9GQmikzLgiaYb0ZPzxwbwgyScsWMifc0FrdbH7+esjQajwROmBVe3Rac26:UAcz9EikngXP6NB8cyz73OH6k86
Malware Config
Extracted
danabot
5
23.254.133.7:443
185.62.58.85:443
213.227.155.102:443
192.236.146.173:443
-
embedded_hash
63B180866F08EFD2B286E54429F1D1E4
-
type
loader
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
rundll32.exeflow pid process 3 2520 rundll32.exe 6 2520 rundll32.exe 8 2520 rundll32.exe 9 2520 rundll32.exe 10 2520 rundll32.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exedescription pid process target process PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe PID 2236 wrote to memory of 2520 2236 a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a244a3b64b61f329489bb5d283bda840_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-0-0x0000000000220000-0x00000000002FD000-memory.dmpFilesize
884KB
-
memory/2236-1-0x0000000000220000-0x00000000002FD000-memory.dmpFilesize
884KB
-
memory/2236-2-0x0000000002010000-0x0000000002231000-memory.dmpFilesize
2.1MB
-
memory/2236-3-0x0000000000400000-0x000000000062E000-memory.dmpFilesize
2.2MB
-
memory/2236-4-0x0000000000400000-0x000000000062E000-memory.dmpFilesize
2.2MB
-
memory/2236-5-0x0000000000400000-0x000000000062E000-memory.dmpFilesize
2.2MB
-
memory/2236-6-0x0000000000400000-0x000000000062E000-memory.dmpFilesize
2.2MB
-
memory/2236-8-0x0000000002010000-0x0000000002231000-memory.dmpFilesize
2.1MB
-
memory/2236-13-0x0000000000400000-0x000000000062E000-memory.dmpFilesize
2.2MB
-
memory/2236-34-0x0000000000400000-0x000000000062E000-memory.dmpFilesize
2.2MB
-
memory/2520-28-0x0000000000080000-0x0000000000083000-memory.dmpFilesize
12KB
-
memory/2520-14-0x0000000000140000-0x0000000000143000-memory.dmpFilesize
12KB
-
memory/2520-15-0x0000000000140000-0x0000000000143000-memory.dmpFilesize
12KB
-
memory/2520-30-0x00000000755D0000-0x00000000755D1000-memory.dmpFilesize
4KB
-
memory/2520-31-0x00000000000A0000-0x00000000000A3000-memory.dmpFilesize
12KB
-
memory/2520-33-0x00000000755B0000-0x00000000756B0000-memory.dmpFilesize
1024KB
-
memory/2520-32-0x00000000755B0000-0x00000000756B0000-memory.dmpFilesize
1024KB
-
memory/2520-29-0x0000000077240000-0x0000000077241000-memory.dmpFilesize
4KB
-
memory/2520-36-0x00000000755D0000-0x00000000755D1000-memory.dmpFilesize
4KB
-
memory/2520-37-0x00000000755B0000-0x00000000756B0000-memory.dmpFilesize
1024KB
-
memory/2520-38-0x00000000755B0000-0x00000000756B0000-memory.dmpFilesize
1024KB
-
memory/2520-41-0x00000000000A0000-0x00000000000A3000-memory.dmpFilesize
12KB
-
memory/2520-42-0x00000000000A0000-0x00000000000A3000-memory.dmpFilesize
12KB
-
memory/2520-44-0x00000000000A0000-0x00000000000A3000-memory.dmpFilesize
12KB
-
memory/2520-49-0x00000000000A0000-0x00000000000A3000-memory.dmpFilesize
12KB