Analysis
-
max time kernel
41s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 21:29
Behavioral task
behavioral1
Sample
1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe
-
Size
1.8MB
-
MD5
05f876eaecb5f74acc2d7d2d2dbc8a80
-
SHA1
2d7e810d07f12c91666ef33b73f2fb28f8ccc8b8
-
SHA256
1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0
-
SHA512
4e02e7eb0a3bccdbd11647bb8e4eca353b0c342470702d2955c15a1a0ac0b223418864a34d5d309257c5ff6785f53c20394d391da5b40787003c829294b532c1
-
SSDEEP
24576:JrtZOeEFbdfAg84s0sk04I6G4+57ZvNdoDQG5LtibEWnmF3HXFjs/iT7qxf4TXSB:E9FVAg9sY+5hgf4bnmFVe8+d7hxp42j
Malware Config
Signatures
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4656 1692 WerFault.exe 1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe 872 1692 WerFault.exe 1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b4a47898ad4ffae7c1d05126ea786690124d4fb9a0c1d3c3c7662b04aee73a0_NeikiAnalytics.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1692 -ip 16921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1692 -ip 16921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1692-0-0x00000000002D0000-0x000000000078C000-memory.dmpFilesize
4.7MB