Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:01
Behavioral task
behavioral1
Sample
a765c3d97bf8f3d152e5717605d1e5f0_NeikiAnalytics.exe
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
a765c3d97bf8f3d152e5717605d1e5f0_NeikiAnalytics.exe
-
Size
556KB
-
MD5
a765c3d97bf8f3d152e5717605d1e5f0
-
SHA1
e02a5e18b81292a41bd0fd54e06556df73d28022
-
SHA256
f35846a408f689f391e863d4aa60babebb770cf1be54603baaa2365144af9d1b
-
SHA512
cdf551c9639abf8cc07863b4d24b0721232e40731a1e0f3b74d2337f7fa39e4f4a39c2a627576337f031729c410eb966a2a2859220aafc1159a0b5c069841ba5
-
SSDEEP
12288:y8AJRvlgwO7RVPFRS8dFdJxeJSVZB86ds4YojpgYW2YCd3lf2qiyWBM:yG15nIQm6drYopg3bWVj6BM
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1152-2-0x000000013FAB0000-0x000000013FBA5000-memory.dmp upx behavioral1/memory/1152-5-0x000000013FAB0000-0x000000013FBA5000-memory.dmp upx behavioral1/memory/1152-0-0x000000013FAB0000-0x000000013FBA5000-memory.dmp upx -
resource yara_rule behavioral1/memory/1152-2-0x000000013FAB0000-0x000000013FBA5000-memory.dmp vmprotect behavioral1/memory/1152-5-0x000000013FAB0000-0x000000013FBA5000-memory.dmp vmprotect behavioral1/memory/1152-0-0x000000013FAB0000-0x000000013FBA5000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1152 a765c3d97bf8f3d152e5717605d1e5f0_NeikiAnalytics.exe