e89591f1413cc7dc72e6f7316a8788a2d53a153e1752b90f087921e38a497580

Analysis

max time kernel
131s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 18:27

Target

078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
Size

73KB
MD5

078d1bc2d6c6fcb6e439a68a640169c0
SHA1

652c45f54a9d71dfa832c0aae07f5282dfd43a5f
SHA256

e89591f1413cc7dc72e6f7316a8788a2d53a153e1752b90f087921e38a497580
SHA512

93d7fc75bbe492eb9fb5619320350eb7fba9958c7edf69f9194fb91bdbd46adfaf9e2dd0af583713ab9e2858e9320a16440aad13ab1df366a9c9fb9d11446527
SSDEEP

1536:hbu8Unt0jKK5QPqfhVWbdsmA+RjPFLC+e5hx0ZGUGf2g:hs0eNPqfcxA+HFshxOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3452	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4512	2888	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	91
PID 2888 wrote to memory of 4512	2888	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	91
PID 2888 wrote to memory of 4512	2888	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	91
PID 4512 wrote to memory of 3452	4512	cmd.exe	92
PID 4512 wrote to memory of 3452	4512	cmd.exe	92
PID 4512 wrote to memory of 3452	4512	cmd.exe	92
PID 3452 wrote to memory of 2996	3452	[email protected]	93
PID 3452 wrote to memory of 2996	3452	[email protected]	93
PID 3452 wrote to memory of 2996	3452	[email protected]	93

C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4072,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
5c24b52678463a06cb4b9c2a1522fc63

SHA1
ff4988559a8efc2204e059055a0cb26106c47531

SHA256
7339bd7177b14846d9cccf2b2267a9d3fcdbcc717a22964fb48d25f5f26317b8

SHA512
e328e487f48eee65bc07b7196f21236362c4edfed952196d8db92644c0a3790506e139888a7a2f5afa1a6702d883020fb5d3fc440b5ed01a10716cea764b0ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2888-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3452-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download