0540d78958f02f977a97b074c9bba97c9f2d6f6379494c6238db6dca09185f20

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:54

Target

6685aad7f4449e1621050ce30e304060_NeikiAnalytics.exe
Size

1.6MB
MD5

6685aad7f4449e1621050ce30e304060
SHA1

6c9087b62f4730628019ee8a5f01259b33d01c42
SHA256

0540d78958f02f977a97b074c9bba97c9f2d6f6379494c6238db6dca09185f20
SHA512

8d2d1d4a37f200080c3dd5df870118ce33713f3da420e1fee17016b99351ef8327b60cdf076519edb2e13dcb192d6ed6db1c4200da313937a125212796d0caa6
SSDEEP

49152:llb7777777777777777777777777777777777777777777777IVFnVFnVFnVFnV9:llc3n3n3n3n3n3n3n3n3n3n3n3n3n3nv

Score

7^/10

upx

Executes dropped EXE 1 IoCs

Processes:

svrwsc.exe

pid process

2900 svrwsc.exe

pid	process
2900	svrwsc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4328-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
C:\Windows\SysWOW64\svrwsc.exe	upx

Drops file in System32 directory 2 IoCs

Processes:

6685aad7f4449e1621050ce30e304060_NeikiAnalytics.exesvrwsc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\svrwsc.exe	6685aad7f4449e1621050ce30e304060_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

C:\Users\Admin\AppData\Local\Temp\6685aad7f4449e1621050ce30e304060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6685aad7f4449e1621050ce30e304060_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:4328

C:\Windows\SysWOW64\svrwsc.exe

Filesize
1.9MB

MD5
3b2a51af81ddcf9e97a7a0a94cccec1c

SHA1
86f0ac6f475b3e34aa9675323c74a854e4ce1f39

SHA256
16c8d697862308cb564355506fdf64adffa2b135b1536d882a7972e786d52674

SHA512
df05dc394abddb277c9eb28b45e1a7f2e1c1c41cec902eadce2ae13a9aabfb66c799d1df707128c773ee3facd1d130746c0afd3369a793de17e9b4f9996fb9ba

Download Submit
memory/2900-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4328-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4328-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4328-1-0x00000000007D0000-0x00000000007D5000-memory.dmp

Filesize
20KB

Download
memory/4328-9-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download