0b91799c320e4896b67b57801b3496690959760621ba05f7116a0849c3eb61c3

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 13:22

Target
e073986c7b0d20b79eef6b1e6b370690_NeikiAnalytics.exe
Size 73KB
Sample240516-qmadtaef41
SHA256 0b91799c320e4896b67b57801b3496690959760621ba05f7116a0849c3eb61c3
MD5 e073986c7b0d20b79eef6b1e6b370690
SHA1 a585dfc77e6bdeeca5e041d0b96c88fa54270eaa
SHA512 e220b316079e084526328d035c63508646c221916532ae30890a00e5fff00731ebe2f027cbdb96f70846d036f2582bf35ff93d45f89ef8bc8ad05fc0fcf515e7
SSDEEP 768:hZZ6Zyf9LrsHM5s39vkq0xEOkhzQLX7v5uZn+5NlemmuLbR+PDl+JTs8SCd+CSPx:1eHpt8q03mUqaoPB8TvSrtXr1CNs9H
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1460	lkakas-ogid.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\lkakas-ogid.exe	e073986c7b0d20b79eef6b1e6b370690_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\lkakas-ogid.exe	e073986c7b0d20b79eef6b1e6b370690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\e073986c7b0d20b79eef6b1e6b370690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e073986c7b0d20b79eef6b1e6b370690_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:5444
- C:\Windows\SysWOW64\lkakas-ogid.exe
  "C:\Windows\system32\lkakas-ogid.exe"
  2⤵
  - Executes dropped EXE
  PID:1460

lkakas-ogid.exe

Path C:\Windows\SysWOW64\lkakas-ogid.exe
Size 70KB
SHA256 952e21351b180e9f3de0344613c0f820cba7cd8823be880930306fb6831f28ff
MD5 8de75bd4b82491cb6d34ec420d53b2b5
SHA1 5d332d2e42f11719af7bc96b25bc1fdff40b5c4d
SHA512 9f0ac8a4c3d8e994450cf069d093bd63859fca38a99c265a1b56765476d8f7fb01fa8f0e8614cbfd8c359477f890ac4238c11a4403dfbfc0c9a6761a71321b05
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8q:Olg35GTslA5t3/w8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5444-3-0x0000000077C02000-0x0000000077C03000-memory.dmp

Download

memory/5444-4-0x0000000000400000-0x0000000000403000-memory.dmp

Download