ac5c2782adbb4bbd6585801f76e9fc09cfd7480dc70cd6ae3a4d2970bfff0a2c

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 18:40

Target

c4daa109b86645b2776ee181848b0720_NeikiAnalytics.exe
Size

73KB
MD5

c4daa109b86645b2776ee181848b0720
SHA1

cea417488aaa1d9aaae1072676de5bd30021687f
SHA256

ac5c2782adbb4bbd6585801f76e9fc09cfd7480dc70cd6ae3a4d2970bfff0a2c
SHA512

1e0e068b38038e9b0c703c82821327a3096d7202e9df4a7ce88bc4b03ecdff262fc98e3a0352dc097aa6cb041e01d3ec2cd7719f49c1989abc816d6780ffa3e1
SSDEEP

1536:hb1EoxLJQX4eHbjiK5QPqfhVWbdsmA+RjPFLC+e5h00ZGUGf2g:h6SJI4e6NPqfcxA+HFsh0Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1528	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2224	2560	c4daa109b86645b2776ee181848b0720_NeikiAnalytics.exe	91
PID 2560 wrote to memory of 2224	2560	c4daa109b86645b2776ee181848b0720_NeikiAnalytics.exe	91
PID 2560 wrote to memory of 2224	2560	c4daa109b86645b2776ee181848b0720_NeikiAnalytics.exe	91
PID 2224 wrote to memory of 1528	2224	cmd.exe	92
PID 2224 wrote to memory of 1528	2224	cmd.exe	92
PID 2224 wrote to memory of 1528	2224	cmd.exe	92
PID 1528 wrote to memory of 220	1528	[email protected]	93
PID 1528 wrote to memory of 220	1528	[email protected]	93
PID 1528 wrote to memory of 220	1528	[email protected]	93

C:\Users\Admin\AppData\Local\Temp\c4daa109b86645b2776ee181848b0720_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c4daa109b86645b2776ee181848b0720_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
25ec3ccaf71eb9023005cd639f130545

SHA1
aad7ae9009f960c63c2a5cea3a4565a3a1cc9171

SHA256
79874c8ba3a5996c1bf4a14dc900a4e4eb625920e292611288ffe9c0230a9bf4

SHA512
62843e61539487553c73f059417cf3df72c62e49673f47ec34e056d35ddf6555499cf5f1fbfb3dad1079edbbc776801dfaa1884291d2459c575e545f121ca296

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1528-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2560-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download