81cafb4dea972a55955e97be209e3ee6f0b12d8001135c0b4bc308ce24f5f498

Analysis

max time kernel
133s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:19

Target

6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe
Size

25KB
MD5

6098197411f7faa1aff6b6dbcef40290
SHA1

620db045bc177a506113c2ae6d85e115b54f7529
SHA256

81cafb4dea972a55955e97be209e3ee6f0b12d8001135c0b4bc308ce24f5f498
SHA512

f432e26ab30d6168cb1f9181aef4c48280256678437f1ca0753f9c30d44c7b36eba7a107879b2e042ae37737439d04baddac4abf8105857c22f5d711e1bcc1bf
SSDEEP

768:ErzUhfEsjHFqf16/m7omoWLANjzI+CksDiJ6Zd:E8hMw0ImDAtzI+6iQf

Score

7^/10

upx

Executes dropped EXE 1 IoCs

Processes:

rmass.exe

pid process

2800 rmass.exe

pid	process
2800	rmass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2800-4-0x0000000000400000-0x0000000000411000-memory.dmp	upx
C:\Windows\SysWOW64\rmass.exe	upx

Drops file in System32 directory 2 IoCs

Processes:

6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\rmass.exe	6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6098197411f7faa1aff6b6dbcef40290_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:2592

C:\Windows\SysWOW64\rmass.exe
"C:\Windows\SysWOW64\rmass.exe"
2⤵
- Executes dropped EXE
PID:2800

C:\Windows\SysWOW64\rmass.exe

Filesize
22KB

MD5
ba429ef4fc0e55bee1d2f45d8228510f

SHA1
073a578ffe3409a5e39f7e6c235e1d6239bdb8f5

SHA256
01c0532eee35776602e5f41917eb3629ddb3b7703de36e9117d9521b038c85e4

SHA512
fb5af022922404ae63b4353e834f3e8295c414e928076c94beb32e6de1ea1590cb253958d97ffd7bc4584d4d81ec4940cec806be56fb55770193d6231cc3b50a

Download Submit
memory/2592-1-0x0000000077252000-0x0000000077253000-memory.dmp

Filesize
4KB

Download
memory/2592-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2800-4-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download