82780b1399c878af402606f64eec2d2c5607c5fa667f0e22431adc986a4f49f7

Analysis

max time kernel
139s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:22

Target

05bc4e0304281e124cb86a8cb84c2f60_NeikiAnalytics.exe
Size

256KB
MD5

05bc4e0304281e124cb86a8cb84c2f60
SHA1

ebb7b83aecaecda8ab76e3ff15d945296d05bafc
SHA256

82780b1399c878af402606f64eec2d2c5607c5fa667f0e22431adc986a4f49f7
SHA512

0307c0894448cc750626361c200c6f37ac29b6fd567dae5656369749b7bfc0f988351cadb06ddc9de2524bef9db081f0ea0c754155bdf506bfb281025d87c030
SSDEEP

6144:5eIk0YujFHsS3jwc25qXIXakFzrAcJFWyQ5dwwN:AXxujdec24YX7JM2MjDN

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

teoghah.exe

pid process

1656 teoghah.exe
Drops file in Program Files directory 1 IoCs

Processes:

05bc4e0304281e124cb86a8cb84c2f60_NeikiAnalytics.exe

description ioc process

File created C:\PROGRA~3\Mozilla\teoghah.exe 05bc4e0304281e124cb86a8cb84c2f60_NeikiAnalytics.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2108 1656 WerFault.exe teoghah.exe

pid	process
1656	teoghah.exe

description	ioc	process
File created	C:\PROGRA~3\Mozilla\teoghah.exe	05bc4e0304281e124cb86a8cb84c2f60_NeikiAnalytics.exe

pid	pid_target	process	target process
2108	1656	WerFault.exe	teoghah.exe

C:\Users\Admin\AppData\Local\Temp\05bc4e0304281e124cb86a8cb84c2f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\05bc4e0304281e124cb86a8cb84c2f60_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3404,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:3168

C:\PROGRA~3\Mozilla\teoghah.exe
C:\PROGRA~3\Mozilla\teoghah.exe -cjiekkn
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 452
2⤵
- Program crash
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1656 -ip 1656
1⤵
PID:3636

C:\ProgramData\Mozilla\teoghah.exe

Filesize
256KB

MD5
408419a4b9a7e2b522e22c96e14cfdd7

SHA1
5c6151f644422bf2402ed66df9f090aa3eaa15fd

SHA256
5114c3d533d877706bfcf69ca51957761561418e74b544a2ebe5725867cb0791

SHA512
395df35adaf761c7639f10cbb610e36050ef681818f3dd10887cf0018ec560b769ce202457794ab73a7d3c6152a7f792f2f93dbac52dcce557d10792e8f2b9df

Download Submit
memory/1656-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3952-1-0x0000000001F60000-0x0000000001FBB000-memory.dmp

Filesize
364KB

Download
memory/3952-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3952-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3952-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3952-9-0x0000000001F60000-0x0000000001FBB000-memory.dmp

Filesize
364KB

Download