02a8f83bd425965bc65db15b81bb4fda4c96adaa9b6b25538ceaab1e9da83a2e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 17:24

Target

3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe
Size

25KB
MD5

3573698b3a11e4a8a40fb14f747671a0
SHA1

f8c772a5596e3d3b3bd4e4946a026354955edc65
SHA256

02a8f83bd425965bc65db15b81bb4fda4c96adaa9b6b25538ceaab1e9da83a2e
SHA512

bf6d200291658d828b7b4b35498a46313634601ef73d2e08bfafea77a310a67fbff529473449e3e335e211a6e45af24e284ab458a6b63bd192b1540d4967c723
SSDEEP

768:ErzMVHDUszMgNLZnIMFhhOZFCPri5Lnrkz:E8DUszLLZnIMdOZ0Priy

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2632	rmass.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000c000000015cce-1.dat	upx
behavioral1/memory/2416-2-0x0000000000020000-0x0000000000031000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rmass.exe	3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\rmass.exe	3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2416
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:2632

\Windows\SysWOW64\rmass.exe

Filesize
21KB

MD5
bf8b25456a01e8d83529954a38fad593

SHA1
a8720ff66b6cbc94ddf55578cdc9353e2a9075c2

SHA256
a01772fb386b1d4e7e9287c7a93902487a9b72b330be314fee6afa17858d3619

SHA512
4844163001b1235c8600c6da863c8395ed7b2f0172b41284633da83c04b245e5de239b6ec0fb4ca015a7e646fc1cfe545f5b2066663067096eea0bde05de83d4

Download Submit
memory/2416-2-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/2416-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download