02a8f83bd425965bc65db15b81bb4fda4c96adaa9b6b25538ceaab1e9da83a2e

Analysis

max time kernel
131s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 17:24

Target

3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe
Size

25KB
MD5

3573698b3a11e4a8a40fb14f747671a0
SHA1

f8c772a5596e3d3b3bd4e4946a026354955edc65
SHA256

02a8f83bd425965bc65db15b81bb4fda4c96adaa9b6b25538ceaab1e9da83a2e
SHA512

bf6d200291658d828b7b4b35498a46313634601ef73d2e08bfafea77a310a67fbff529473449e3e335e211a6e45af24e284ab458a6b63bd192b1540d4967c723
SSDEEP

768:ErzMVHDUszMgNLZnIMFhhOZFCPri5Lnrkz:E8DUszLLZnIMdOZ0Priy

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2392	rmass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2392-4-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/files/0x0009000000023297-3.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\rmass.exe	3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3573698b3a11e4a8a40fb14f747671a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:2688
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:2392

C:\Windows\SysWOW64\rmass.exe

Filesize
21KB

MD5
bf8b25456a01e8d83529954a38fad593

SHA1
a8720ff66b6cbc94ddf55578cdc9353e2a9075c2

SHA256
a01772fb386b1d4e7e9287c7a93902487a9b72b330be314fee6afa17858d3619

SHA512
4844163001b1235c8600c6da863c8395ed7b2f0172b41284633da83c04b245e5de239b6ec0fb4ca015a7e646fc1cfe545f5b2066663067096eea0bde05de83d4

Download Submit
memory/2392-4-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2688-1-0x00000000778B2000-0x00000000778B3000-memory.dmp

Filesize
4KB

Download
memory/2688-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download