Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 22:51
Behavioral task
behavioral1
Sample
0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
-
Size
9.2MB
-
MD5
3827d850535d0e7370e5963ba189a250
-
SHA1
4a7052caef6165a2e42d986bf5a3f87e6c307ba9
-
SHA256
0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c
-
SHA512
ed8ac09379e9dd37504ba44721688230fe00b7ed3fc5da7daf063b2beda8899f5b384e746e5fa6f3106c3701e8a99f3a6c360d023706a9d07f9b9f5f39f6832f
-
SSDEEP
196608:gDIY29OuiQYmmfJVcyxIMcMrHKVMEvKs7DGlAi9Q3QRr+jup:7Y29OPmOJVcyxIMcMT+mAQ8rjup
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1912-63-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-59-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1912-39-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/1912-82-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-36-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-126-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-127-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-128-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-129-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-130-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-131-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-132-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-133-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-134-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-135-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-136-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-138-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-139-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-140-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect behavioral1/memory/1912-141-0x0000000000400000-0x0000000001B83000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exepid process 1912 0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe 1912 0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exepid process 1912 0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe 1912 0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe 1912 0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe 1912 0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0948a6e361d814ee7a34088f0a898706aea84359ec60740258176cfbbbef947c_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1912-29-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/1912-34-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1912-32-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1912-82-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-63-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-59-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-57-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-55-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-53-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-51-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-40-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1912-30-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1912-27-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/1912-24-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1912-22-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1912-19-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1912-17-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1912-14-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1912-12-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1912-9-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1912-7-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1912-5-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1912-4-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1912-2-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1912-0-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1912-36-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-37-0x0000000000CD3000-0x0000000001259000-memory.dmpFilesize
5.5MB
-
memory/1912-126-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-127-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-128-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-129-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-130-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-131-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-132-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-133-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-134-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-135-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-136-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-137-0x0000000000CD3000-0x0000000001259000-memory.dmpFilesize
5.5MB
-
memory/1912-138-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-139-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-140-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB
-
memory/1912-141-0x0000000000400000-0x0000000001B83000-memory.dmpFilesize
23.5MB