Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 10:28
Behavioral task
behavioral1
Sample
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe
-
Size
900KB
-
MD5
4b29ffb60c0e5f5e9bfecff0061cfa6b
-
SHA1
badd38b886077e082a3fbe025c1e7d0f177de7f4
-
SHA256
36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f
-
SHA512
35eee9f167174e8a2816a2a90e690c9aa8dee7ca9df33c85f957495473dbaecc1d96ea18f17ca75ab2da7f6ed15167d91552ffed4793fdd1fd14d244857f448c
-
SSDEEP
24576:cdBS2pWPPcyfi7dlXhgWs+2iMllfi706uZS/2IsH:sB/p2+2PC/2IsH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2392-0-0x000000013FB50000-0x000000013FC31000-memory.dmp vmprotect behavioral1/memory/2392-2-0x000000013FB50000-0x000000013FC31000-memory.dmp vmprotect behavioral1/memory/2392-1-0x000000013FB50000-0x000000013FC31000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2392 36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\36685efcf34c7a7a6f6dd2e48199e4700b5ab8fe3945a50297703dd8daced74f_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2392