1bd732aa77751c7cba72448e4de7d4edd54c677241de2e93af42e0e31beca570

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:57

Target

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
Size

384KB
MD5

5d3539e22f24793a7296eee236095190
SHA1

8db92d2a8e2f8490c2ebe714e74041eee6c60815
SHA256

1bd732aa77751c7cba72448e4de7d4edd54c677241de2e93af42e0e31beca570
SHA512

80f1eceafc64b0e9b8ae3a61f909aac4fae93e58cbd23ff22cf7ab98f3f054152bdfbf6650c9375fc1313a06ade910ef6ed43e528bb96f8c07b3cee9f46a4a88
SSDEEP

12288:MY9EBDFq+5zU1nLDdFbHZ+XsSOk4+hu+eNWhVQ5zCD4TS:MY9MDFhYHQAWhVQ5zY4+

Score

7^/10

Deletes itself 1 IoCs

Processes:

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid process

2452 5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid process

2452 5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
Loads dropped DLL 1 IoCs

Processes:

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid process

3056 5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid process

3056 5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid process

2452 5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid	process
2452	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid	process
2452	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid	process
3056	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid	process
3056	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

pid	process
2452	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

description	pid	process	target process
PID 3056 wrote to memory of 2452	3056	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
PID 3056 wrote to memory of 2452	3056	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
PID 3056 wrote to memory of 2452	3056	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
PID 3056 wrote to memory of 2452	3056	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe	5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe

\Users\Admin\AppData\Local\Temp\5d3539e22f24793a7296eee236095190_NeikiAnalytics.exe
Filesize
384KB

MD5
cba0ae2497d7a5e3dfa480a759b4ace7

SHA1
5f46ada6c4a8f537eb889c3b967a94d39dc1cbbc

SHA256
56f9f8cbdbd9a382db47b2c786b3efa77e0f2063c2bd1d22adacbc2a57ffd2d8

SHA512
d6832382597444ce2df3aeef6353960cef2ac8af8ca70c9e20397a936ff7714dbf7d5cd4e36f6f067e464e96fe458399ff8afd9bac8e5a00a91eb2c605baa1f7

Download Submit
memory/2452-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2452-13-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2452-17-0x0000000000130000-0x0000000000176000-memory.dmp

Filesize
280KB

Download
memory/2452-18-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3056-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3056-5-0x0000000000190000-0x00000000001D6000-memory.dmp

Filesize
280KB

Download
memory/3056-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download