Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 12:58
Static task
static1
Behavioral task
behavioral1
Sample
ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe
-
Size
32KB
-
MD5
2023fe259b9c60921db67b6d0c5091b0
-
SHA1
6ca83e3342bf2706816db3454f7bf1c2017b133d
-
SHA256
ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c
-
SHA512
7d2c3e872cb574cd2e7f9cb46f22d96e6739b3c7668b054ab0044b45163e96eb359c03585bd4dff9f45ead288be1128656e8ddeeb6fbe1bdf0b7e994b013c92e
-
SSDEEP
768:ktkSEpBYWOqpRz+Oza7hYUtXz8z7nIV9dr2V9r7Dk9J:ckBpvTz+B7xYY/KV9Q9J
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\5F1BD5A7 = "C:\\Users\\Admin\\AppData\\Roaming\\5F1BD5A7\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe 1936 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winver.exepid process 1936 winver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exewinver.exedescription pid process target process PID 2320 wrote to memory of 1936 2320 ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe winver.exe PID 2320 wrote to memory of 1936 2320 ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe winver.exe PID 2320 wrote to memory of 1936 2320 ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe winver.exe PID 2320 wrote to memory of 1936 2320 ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe winver.exe PID 2320 wrote to memory of 1936 2320 ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe winver.exe PID 1936 wrote to memory of 1204 1936 winver.exe Explorer.EXE PID 1936 wrote to memory of 1124 1936 winver.exe taskhost.exe PID 1936 wrote to memory of 1172 1936 winver.exe Dwm.exe PID 1936 wrote to memory of 1204 1936 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ac69a8bb28aabbfce04f19ac1b8262f7570d6a703bc9f9a70f2a84e27e15fa7c_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1124-23-0x0000000000490000-0x0000000000496000-memory.dmpFilesize
24KB
-
memory/1124-24-0x00000000775F1000-0x00000000775F2000-memory.dmpFilesize
4KB
-
memory/1172-26-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/1172-20-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB
-
memory/1204-22-0x0000000002530000-0x0000000002536000-memory.dmpFilesize
24KB
-
memory/1204-3-0x0000000002580000-0x0000000002586000-memory.dmpFilesize
24KB
-
memory/1204-2-0x0000000002580000-0x0000000002586000-memory.dmpFilesize
24KB
-
memory/1204-4-0x0000000002580000-0x0000000002586000-memory.dmpFilesize
24KB
-
memory/1204-25-0x0000000002530000-0x0000000002536000-memory.dmpFilesize
24KB
-
memory/1204-10-0x00000000775F1000-0x00000000775F2000-memory.dmpFilesize
4KB
-
memory/1936-7-0x00000000777A0000-0x00000000777A1000-memory.dmpFilesize
4KB
-
memory/1936-6-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB
-
memory/1936-8-0x000000007779F000-0x00000000777A0000-memory.dmpFilesize
4KB
-
memory/1936-9-0x000000007779F000-0x00000000777A1000-memory.dmpFilesize
8KB
-
memory/1936-11-0x00000000775A0000-0x0000000077749000-memory.dmpFilesize
1.7MB
-
memory/1936-30-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB
-
memory/2320-12-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2320-13-0x0000000001CE0000-0x00000000026E0000-memory.dmpFilesize
10.0MB
-
memory/2320-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2320-5-0x0000000001CE0000-0x00000000026E0000-memory.dmpFilesize
10.0MB
-
memory/2320-1-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB