b8973e62270d13d2491f50bafb88a184736151dd5cee0685fe3f3a47f3021344

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 08:20

Target

d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe
Size

500KB
MD5

d3bd103a9bb2e13681b65db8404120a0
SHA1

9a121d0a16a071f5cb7373a0d840d0549b95ef25
SHA256

b8973e62270d13d2491f50bafb88a184736151dd5cee0685fe3f3a47f3021344
SHA512

f96907f543e23c114ba6431dead0ea6f8caa5e8a3cabe678d821208c91fa2b482d4b5cf2f731395c4876383a97c426058650e67e0f1fe5130ee25b9bcf431a91
SSDEEP

12288:8WBm+95nHfF2mgewFx5ndrqz6/EAHSbZeYA16wqp1kfgjdkA:8WBz95ndbgfx51REAHqZe16CgjT

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1980	F5D.tmp

Executes dropped EXE 1 IoCs

pid	Process
1980	F5D.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1980	824	d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe	90
PID 824 wrote to memory of 1980	824	d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe	90
PID 824 wrote to memory of 1980	824	d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\F5D.tmp
  "C:\Users\Admin\AppData\Local\Temp\F5D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\d3bd103a9bb2e13681b65db8404120a0_NeikiAnalytics.exe 83B3E78D2A7A7A4C18F6EA8BE88B1A0B28BB72BD4C709E4F41137359BCEE76A88D76750E3627281DADC0FE35B0F9C2B82637962A91A7CE5DBC7F3327E8B1D4DA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3624

C:\Users\Admin\AppData\Local\Temp\F5D.tmp

Filesize
500KB

MD5
517d6350b3b49cdb16429274c8b5912f

SHA1
934f68af2bf661cf4566e09cff56831a03059e19

SHA256
4c1d742a0d5463da097ecc5f415d6a98dc0f0b1b42833f73cac7fa11c4d37f9d

SHA512
3c4f923896527d66758a3fb0c520da7b33a06c5af6e18d89fad11dda486228fb872645fb6ba55e540829a4890f11981f6cae1bc37d95fd05fea074e2f7827f52

Download Submit
memory/824-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/824-7-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1980-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1980-8-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download