4ceb3a3efe9f704cb0f8e8906abd29ba2d00698a1ca0c50171aee332d15fa8d0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:09

Target

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Size

59KB
MD5

69c0edbb56ee74955f1a6e17fe8fb960
SHA1

9c2764531749c3d9cfdecf4cfc8cfdf681318edc
SHA256

4ceb3a3efe9f704cb0f8e8906abd29ba2d00698a1ca0c50171aee332d15fa8d0
SHA512

9a37259f83c8ab443ab7a6203e8a73f3a274810136fbb83dac45d2209560d63da74cf7dabc3bf0f96fb6fc6f81860236bb2d318b175714aa5ddb6de73a1817eb
SSDEEP

1536:+7o8uN+FHNkGWf2W3Ayrk5tn1OuFjXVQZjtzYDK2z6:+7orN+F6GW+KAAkj0uFjFgtEDK1

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

2736 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

2736 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Loads dropped DLL 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

1996 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
2736	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
2736	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	upx
behavioral1/memory/1996-12-0x0000000000180000-0x00000000001BD000-memory.dmp	upx
behavioral1/memory/2736-17-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

1996 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

1996 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
2736 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
2736	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

description	pid	process	target process
PID 1996 wrote to memory of 2736	1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
PID 1996 wrote to memory of 2736	1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
PID 1996 wrote to memory of 2736	1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
PID 1996 wrote to memory of 2736	1996	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

\Users\Admin\AppData\Local\Temp\69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Filesize
59KB

MD5
f19add5554ce4196cb58fdb34c69115d

SHA1
a814572e644d674dd50a4ae394fa6ac9d46e7abd

SHA256
3a9d6859306e22994d2f0897c14ef25a93cd5e57a9beac23f3ed1c89d771c465

SHA512
85b054b2a8816196e5317c7153b0bcf5e4c889fcb18b78b9057e3d8a9aa38ed4a2c5f6817c670dbc61d44b717e12189e8905081109f36a38d42a154d86772b8e

Download Submit
memory/1996-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1996-1-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/1996-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1996-12-0x0000000000180000-0x00000000001BD000-memory.dmp

Filesize
244KB

Download
memory/2736-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2736-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2736-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2736-28-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2736-29-0x0000000000170000-0x000000000018D000-memory.dmp

Filesize
116KB

Download
memory/2736-30-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download