Overview

overview

10

Static

static

10

368f53a5f3...cs.exe

windows7-x64

7

368f53a5f3...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    368f53a5f397ba108c81293f648e2480_NeikiAnalytics.exe

  • Size

    80KB

  • MD5

    368f53a5f397ba108c81293f648e2480

  • SHA1

    77774a039399e5d5a9e184dbc7f1f4063cea54e9

  • SHA256

    e4e25a90ab5dbb5ee3acf91c2545ea0cbda455110f0ca01a0fa4e36bc3b251be

  • SHA512

    98914940b7c27d9ad3d06ff72082e5a08980735de612b4003717c1e9c11186d5b222f28b2f1c6205ce3698cff70006f637df2908d101f92304d298a410e8f1f9

  • SSDEEP

    1536:+QuEfLuCnhMemdroxG2h3sdxuaoFpaLO7QRsc/8e373C90CmuJd4BXL:rJfKCTmdroxGA8t2paLW5erYBbd45

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\368f53a5f397ba108c81293f648e2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\368f53a5f397ba108c81293f648e2480_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\368f53a5f397ba108c81293f648e2480_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\368f53a5f397ba108c81293f648e2480_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\368f53a5f397ba108c81293f648e2480_NeikiAnalytics.exe
    Filesize

    80KB

    MD5

    276ed309705a9d26a7dc5df44ad06928

    SHA1

    005dabda5868fc63cc7769160c68ccfc220f3dad

    SHA256

    4326cc86aea1a35f767cbd996963c6d586e0d0ff0e266a9ee5cbf294aa528c8d

    SHA512

    d47d20c49883947365a19c8e49ae25a6c67f282668594e209cd697d4d3c949cb7fbf1915c5a24da73605fb687ddcb70ec0c3f22f520c3a7467ce1848d1c97ab8

    Download Submit
  • memory/1920-0-0x0000000000400000-0x000000000043A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/1920-1-0x00000000001C0000-0x00000000001CE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1920-3-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/1920-12-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/2140-13-0x0000000000400000-0x000000000043A000-memory.dmp
    Filesize

    232KB

    Download
  • memory/2140-14-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/2140-19-0x00000000000C0000-0x00000000000CE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2140-20-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2140-25-0x00000000014C0000-0x00000000014DB000-memory.dmp
    Filesize

    108KB

    Download
  • memory/2140-26-0x0000000000400000-0x000000000043A000-memory.dmp
    Filesize

    232KB

    Download