Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 11:18
Static task
static1
Behavioral task
behavioral1
Sample
95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe
-
Size
158KB
-
MD5
9946e148b483ec9ffbaa721c4ba7d2a0
-
SHA1
768e539ccade7b6baa9df2f36590ac8a3d7105c6
-
SHA256
95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b
-
SHA512
f1832200c7896f997a6e4c35e4130ab4eb81d10fcabc9dd643cfea6e30dfcfe6da4962dc41ef9f80497fa531cb8a32dc4c5c507640162d913fbcb8f55afbe04c
-
SSDEEP
3072:3RTddwY0JwsR4TbswYqkX5bEdGDOjESHhddJWjjY/ffIg0ju2UBsDMmYTddwY0Je:3BIMT7
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2476 1848 WerFault.exe 95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1848 95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exedescription pid process target process PID 1848 wrote to memory of 2476 1848 95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe WerFault.exe PID 1848 wrote to memory of 2476 1848 95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe WerFault.exe PID 1848 wrote to memory of 2476 1848 95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe WerFault.exe PID 1848 wrote to memory of 2476 1848 95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\95342506ae387147159242d5efdb3ea052e75dcaeae043cdd5fef423839eb07b_NeikiAnalytics.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 12122⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1848-0-0x000000007423E000-0x000000007423F000-memory.dmpFilesize
4KB
-
memory/1848-1-0x0000000000C30000-0x0000000000C5C000-memory.dmpFilesize
176KB
-
memory/1848-2-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB
-
memory/1848-3-0x000000007423E000-0x000000007423F000-memory.dmpFilesize
4KB
-
memory/1848-4-0x0000000074230000-0x000000007491E000-memory.dmpFilesize
6.9MB