Overview

overview

7

Static

static

3

6098197411...cs.exe

windows7-x64

7

6098197411...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 00:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe

  • Size

    25KB

  • MD5

    6098197411f7faa1aff6b6dbcef40290

  • SHA1

    620db045bc177a506113c2ae6d85e115b54f7529

  • SHA256

    81cafb4dea972a55955e97be209e3ee6f0b12d8001135c0b4bc308ce24f5f498

  • SHA512

    f432e26ab30d6168cb1f9181aef4c48280256678437f1ca0753f9c30d44c7b36eba7a107879b2e042ae37737439d04baddac4abf8105857c22f5d711e1bcc1bf

  • SSDEEP

    768:ErzUhfEsjHFqf16/m7omoWLANjzI+CksDiJ6Zd:E8hMw0ImDAtzI+6iQf

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1540
    • C:\Windows\SysWOW64\rmass.exe
      "C:\Windows\SysWOW64\rmass.exe"
      2⤵
      • Executes dropped EXE
      PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\rmass.exe
    Filesize

    22KB

    MD5

    ba429ef4fc0e55bee1d2f45d8228510f

    SHA1

    073a578ffe3409a5e39f7e6c235e1d6239bdb8f5

    SHA256

    01c0532eee35776602e5f41917eb3629ddb3b7703de36e9117d9521b038c85e4

    SHA512

    fb5af022922404ae63b4353e834f3e8295c414e928076c94beb32e6de1ea1590cb253958d97ffd7bc4584d4d81ec4940cec806be56fb55770193d6231cc3b50a

    Download Submit

  • memory/1540-2-0x0000000000020000-0x0000000000031000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1540-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

    Download