7ff9ded15ed921c55d5eeac53ff83d6d4906da59bb36280737fc7e72e43639c5

Analysis

max time kernel
141s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 11:02

Target

1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe
Size

5.0MB
MD5

1c19a44740138f65b4b2a631b0078420
SHA1

63a07297db36efc137d42ce92ab0c4cd56b6d0ac
SHA256

7ff9ded15ed921c55d5eeac53ff83d6d4906da59bb36280737fc7e72e43639c5
SHA512

ccc74cce4612dda9e41b4dd3a793b1c4040d7a9ae192ef160101061006e4e6a2619b43d764845a37b4f15c53c9bdf809de09960081fd4e86227745d92bcd603e
SSDEEP

98304:9FSPl6PaAsaAEAsAEACaAEAsAkEAzsaAEAsAEACaAmAEAsAkEAzsaAEAsAEAC+:LSPl6PaAsaAEAsAEACaAEAsAkEAzsaAQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4028	iyokepb.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4028	iyokepb.exe
4028	iyokepb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4028	3156	1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe	81
PID 3156 wrote to memory of 4028	3156	1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe	81
PID 3156 wrote to memory of 4028	3156	1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\iyokepb.exe
  C:\Users\Admin\AppData\Local\Temp\iyokepb.exe -run C:\Users\Admin\AppData\Local\Temp\1c19a44740138f65b4b2a631b0078420_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4028

C:\Users\Admin\AppData\Local\Temp\iyokepb.exe

Filesize
6.2MB

MD5
25abe1a03e167d75ec7f20e8d7cdd175

SHA1
258e2d523ba6bb2f48007ffc8f28695b091c3bf4

SHA256
1f34b37b111b0b56d3478ccfdd024aed01edb719a90ed02266ba1ee5fcf50998

SHA512
9a3ebc2ce47ca524341865565f7321f2e68e2e4fc59b6578e7db5b063592ecbaf6755fd0cdd0e8ed2e08e35c3d6825aa2d26c00bb489df31f3425697cd856ecd

Download Submit
memory/3156-0-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/3156-1-0x00000000005A5000-0x00000000005A6000-memory.dmp

Filesize
4KB

Download
memory/3156-7-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/4028-8-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/4028-10-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/4028-18-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download