4ceb3a3efe9f704cb0f8e8906abd29ba2d00698a1ca0c50171aee332d15fa8d0

Analysis

max time kernel
133s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:09

Target

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Size

59KB
MD5

69c0edbb56ee74955f1a6e17fe8fb960
SHA1

9c2764531749c3d9cfdecf4cfc8cfdf681318edc
SHA256

4ceb3a3efe9f704cb0f8e8906abd29ba2d00698a1ca0c50171aee332d15fa8d0
SHA512

9a37259f83c8ab443ab7a6203e8a73f3a274810136fbb83dac45d2209560d63da74cf7dabc3bf0f96fb6fc6f81860236bb2d318b175714aa5ddb6de73a1817eb
SSDEEP

1536:+7o8uN+FHNkGWf2W3Ayrk5tn1OuFjXVQZjtzYDK2z6:+7orN+F6GW+KAAkj0uFjFgtEDK1

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

2828 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

2828 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
2828	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
2828	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/548-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	upx
behavioral2/memory/2828-13-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

548 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid process

548 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
2828 69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
548	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

pid	process
548	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
2828	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

description	pid	process	target process
PID 548 wrote to memory of 2828	548	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
PID 548 wrote to memory of 2828	548	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
PID 548 wrote to memory of 2828	548	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe	69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\69c0edbb56ee74955f1a6e17fe8fb960_NeikiAnalytics.exe
Filesize
59KB

MD5
8c2451b19ab673a4fa8dec9e088b33ce

SHA1
ae76f546b72113cafa73b5cb32c8e98dd5392459

SHA256
dd76409b05dec0f697eda06703b89bd81c8db0e42a61c80817ade24f7609070f

SHA512
47a573c2cab70da7215eef683301fb7c76cdf8505e90e41b359bf27399f00f28e7ca78a1c622c9a4bc82cab48912d0db5cdf9f4d3bc7b77a51a73dd7de1bfcc7

Download Submit
memory/548-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/548-1-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/548-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/548-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2828-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2828-14-0x00000000000C0000-0x00000000000CF000-memory.dmp

Filesize
60KB

Download
memory/2828-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2828-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2828-25-0x0000000004D60000-0x0000000004D7D000-memory.dmp

Filesize
116KB

Download
memory/2828-26-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download