14130f936b583b809710130b9b214295228c79960cc8b24e2963c8f7c369bdda

Analysis

max time kernel
134s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 06:10

Target

65666e1ca28e1899e24102ccbb7746c0_NeikiAnalytics.exe
Size

108KB
MD5

65666e1ca28e1899e24102ccbb7746c0
SHA1

e49627e820462df19266513b266912ae5ad3232d
SHA256

14130f936b583b809710130b9b214295228c79960cc8b24e2963c8f7c369bdda
SHA512

f4ffef1c806b30d3c9ae67ca1422186f6a95d8837dfd49722d76f49b949e24cf53ffa7d6ea5c0966322a80eaba7934c99bb99dd51a4a3272faf0ea6f1968c7ca
SSDEEP

3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtNa:mh7c5dFK70K7Nq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2288	teoghah.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\teoghah.exe	65666e1ca28e1899e24102ccbb7746c0_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	2288	WerFault.exe	102

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2288	teoghah.exe
2288	teoghah.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	teoghah.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3436	2288	teoghah.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\65666e1ca28e1899e24102ccbb7746c0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\65666e1ca28e1899e24102ccbb7746c0_NeikiAnalytics.exe"
  2⤵
  - Drops file in Program Files directory
  PID:696

C:\PROGRA~3\Mozilla\teoghah.exe
C:\PROGRA~3\Mozilla\teoghah.exe -cjiekkn
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 504
  2⤵
  - Program crash
  PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2288 -ip 2288
1⤵
PID:2300

C:\ProgramData\Mozilla\teoghah.exe

Filesize
108KB

MD5
6495cd9f13618d74deca8a36d27977be

SHA1
59fc4871f590939de2f4dac22ca441611f752b66

SHA256
7e7d1323f477129e71634063e7c9900455be3678908d2ee9f3ac2dae7b479337

SHA512
052547503bff8dceadd6893289ac28096ed1714d36e601d7c04783c15ee8db2ae67c3fd4583a7065b50c9d0ecd6ab2d3efc163ccc3b6126e3ce3fcfacc3543e0

Download Submit
memory/3436-3-0x0000000002580000-0x000000000259C000-memory.dmp

Filesize
112KB

Download