fc9a054eb5f874865bce164494ac28fd311a2a8b619db6580c5ca6e3b5a599c3

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 15:17

Target

d8355ecd202d5858a3b6cd21344197f0_NeikiAnalytics.exe
Size

25KB
MD5

d8355ecd202d5858a3b6cd21344197f0
SHA1

89fccefc70f16fef408dc247663676c092bd815c
SHA256

fc9a054eb5f874865bce164494ac28fd311a2a8b619db6580c5ca6e3b5a599c3
SHA512

0e8c7dc23e32b537ab4b02653f90c51eff91db3319b2ad6406bee6571becb2b35f420cd1417ac600ba23444a06bf623339104a8a7a37922f9bd2b9ca240d9ce6
SSDEEP

768:ErzjNdM3IdLV7Lzg2R+760q4xxAcBoU+1Q:ELvvU2x0evT1Q

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
3324	rmass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0006000000023298-2.dat	upx
behavioral2/memory/3324-3-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	d8355ecd202d5858a3b6cd21344197f0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\rmass.exe	d8355ecd202d5858a3b6cd21344197f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d8355ecd202d5858a3b6cd21344197f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d8355ecd202d5858a3b6cd21344197f0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:2604
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:3324

C:\Windows\SysWOW64\rmass.exe

Filesize
21KB

MD5
b5b496c69f412729085d1000dfc3c0d3

SHA1
ddc0681b47bb7358fa6040fb6b4964a79b19c0fc

SHA256
d2a713b68d3f8ecffb1027ca4ac9d97ebce06d0eb4e27a92068e006911ca1622

SHA512
d31122ee2193808a644cbf34fd9967b3d3f610d1ae74c801fe314c5c71aff9fb0096ffce8c4223a4730382a127b75558f24f5b2ccbcc853f6f20a77fc2e27fd0

Download Submit
memory/2604-4-0x0000000077812000-0x0000000077813000-memory.dmp

Filesize
4KB

Download
memory/2604-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3324-3-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download