fac2911c584f9f9cfb77ac71953fdfc13aee3320a328341e3d119561caaed8ae

Analysis

max time kernel
136s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 01:44

Target
50218d7cb10ccb159ca15bd8fd79c6e0_NeikiAnalytics.exe
Size 73KB
Sample240511-b6aflagh79
SHA256 fac2911c584f9f9cfb77ac71953fdfc13aee3320a328341e3d119561caaed8ae
MD5 50218d7cb10ccb159ca15bd8fd79c6e0
SHA1 a5a89bf56b94cadaaa6813e582383a30590a2afc
SHA512 43f8e6bcc02a7dc878fca0bc2746f88e20589625eb8c64cf9a3f340ee5f8d20d5af905cae3bca40c9abfd1b64c4c7002eedba47525ad27e06c8dfad372e5655f
SSDEEP 1536:1YF8NLCofRLCg/pdsHT+obdo8Cgzvl4ooofgke253u2DE:uF+LCofRLCgxSzXo8CgpIo53u2DE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
860	olmaroac-efid.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\olmaroac-efid.exe	50218d7cb10ccb159ca15bd8fd79c6e0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\olmaroac-efid.exe	50218d7cb10ccb159ca15bd8fd79c6e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\50218d7cb10ccb159ca15bd8fd79c6e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50218d7cb10ccb159ca15bd8fd79c6e0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:1512
- C:\Windows\SysWOW64\olmaroac-efid.exe
  "C:\Windows\SysWOW64\olmaroac-efid.exe"
  2⤵
  - Executes dropped EXE
  PID:860

olmaroac-efid.exe

Path C:\Windows\SysWOW64\olmaroac-efid.exe
Size 70KB
SHA256 edf5962c8c368e88a118fe888168f3f4d731123239b73c983985f6c9ab931214
MD5 aedac633e158f48954c7fef51c0f0b45
SHA1 1781c9206ea40741c5d8e14bd3fe8cebac3d65f5
SHA512 8d78e3352df87a764ba17b19f082abbc4693c616d847deee1b328faf1d635c179e1f576e8e0e5648e6cdfba389749b5c5c0a8931a94d57ab28206e588867348f
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slYC:Olg35GTslA5t3/w8e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-0-0x00000000775A2000-0x00000000775A3000-memory.dmp

Download

memory/1512-4-0x0000000000400000-0x0000000000403000-memory.dmp

Download