9d389852a1b81a75de2e72b9da27a1ab832797d03f69235bb081c4912d6ab328

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:31

Target

788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
Size

4.8MB
MD5

788477b87e9f17b4954b48a354923dc0
SHA1

10e545807dbe396a2f8387ffb6f8ca049ee308e9
SHA256

9d389852a1b81a75de2e72b9da27a1ab832797d03f69235bb081c4912d6ab328
SHA512

5d583f7cf96bf6039bcf9e7e4d7fe8c6bd4b7534bbc4c7a3d9ff97d850103b69ee31e553260b348036c25731b7103cfbd8125074c5fd1b937446d1c5045fc0be
SSDEEP

98304:zL0fIaBCHMhiiXgfDKUcJKJh5D5VndrWjs8O+lYXhzUDPxf89n9K:XJshNQfD0KHVdrWjA+MOPxf89s

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

description ioc process

File created C:\Windows\wc98pp.dll 788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\wc98pp.dll	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

Modifies registry class 6 IoCs

Processes:

788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\CLSID = "{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}"	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ = "C:\\Windows\\wc98pp.dll"	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBCA9F81-8F4F-11D2-90FF-0080C83D3571}\InprocServer32\ThreadingModel = "Apartment"	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

pid process

2000 788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
2000 788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

pid	process
2000	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe
2000	788477b87e9f17b4954b48a354923dc0_NeikiAnalytics.exe

memory/2000-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/2000-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2000-3-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/2000-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download