Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 00:19

General

  • Target

    4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe

  • Size

    1.6MB

  • MD5

    4ccfca9af3375bdeae3b384305564a00

  • SHA1

    bdc0dcec8b863ecf7aa35490e67c62f78cbc5de6

  • SHA256

    05f7e41678aa8de17aa2da086eb932bc272df112ce52427e67229b11eb48807b

  • SHA512

    c39dee00a42d32ab0eb8e1e3d634ee389c75d8f43b990ac56d0a55cf674c2cba5e8d176467d47e0c052f553f107d1a17c3dd18b920c7c0aa4711509f3f06bd49

  • SSDEEP

    24576:+6ljTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT8:llw

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4ccfca9af3375bdeae3b384305564a00_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    PID:468
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    2.0MB

    MD5

    596961e6729c94362fe227555c9eca70

    SHA1

    d43889748c369eceecee88defbd21b84a5b68ced

    SHA256

    0f2b87271c1c6c67612c1f5c04509e1398c424ba086de51af278b5457464ab31

    SHA512

    f5f6e8f00dce1923011188839ad809d1170e4561faf008c959fee2ef780fd8f660068e088b37f419e12d51a74d07a7ee7e266d49670bb28dfdc8943fce104d31

  • memory/468-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/468-2-0x0000000001570000-0x0000000001575000-memory.dmp

    Filesize

    20KB

  • memory/468-3-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4344-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB