cfa4cc4d653b0328e8007fdb9ea2599b6f073bbf4fd047ec9b0e9a266f7ebb1c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:09

Target

3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe
Size

73KB
MD5

3c294fb80666b38484b4eecee9dc23c0
SHA1

f32079cc8c269181650dc3123cec9b75945b9eb0
SHA256

cfa4cc4d653b0328e8007fdb9ea2599b6f073bbf4fd047ec9b0e9a266f7ebb1c
SHA512

748e093c3d544e76bb11840892ebf05243e5d53ed7ce74c6ddbae391c3b1b5e17c00dad1087fcc48af7b831057d3bd6f806a2b5818d403797e0d5ca4f4ec7d26
SSDEEP

1536:hbRq1lLZM7X/PK5QPqfhVWbdsmA+RjPFLC+e5ha0ZGUGf2g:h1qPajNPqfcxA+HFshaOg

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

1632 [email protected]

pid	process
1632	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.execmd.exe[email protected]

description	pid	process	target process
PID 2240 wrote to memory of 3088	2240	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 2240 wrote to memory of 3088	2240	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 2240 wrote to memory of 3088	2240	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 3088 wrote to memory of 1632	3088	cmd.exe	[email protected]
PID 3088 wrote to memory of 1632	3088	cmd.exe	[email protected]
PID 3088 wrote to memory of 1632	3088	cmd.exe	[email protected]
PID 1632 wrote to memory of 3000	1632	[email protected]	cmd.exe
PID 1632 wrote to memory of 3000	1632	[email protected]	cmd.exe
PID 1632 wrote to memory of 3000	1632	[email protected]	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3000

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
95f6aec276ab5e81e4e6a340ad2e0764

SHA1
d4aac2c393fca86fc3830c8764769def2ba1f98b

SHA256
d25410ecbeb537bd324bc32e3c933be61465016921b62afd945b249cc5c262a7

SHA512
c5903f5d5765179d2a38fa64c4dfa716d311959e1c31ff6a74956bd70324902c67474db7878faa278401472b9d9c564b7f2199b6be883d39b4aac982de50ac64

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1632-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2240-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download