453d9dcba9847aa2a8bd6685d79ff62f566ca0a51a7696f8f0615389d89627a9

Analysis

max time kernel
157s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe
Size 8.6MB
Sample240526-eazx6adf8s
SHA256 453d9dcba9847aa2a8bd6685d79ff62f566ca0a51a7696f8f0615389d89627a9
MD5 5e15074d26b39f6159ce1b3d499a0a40
SHA1 6d3b3acf2422a20a251ef6268ecf16d1a1d6031c
SHA512 a098518a93c5ab3b123af5dc5f62ea375da72f17d0570ec25a79679ef7f5218f4b6a6b84f8f4289e57b93d34746f5ab0ac4a69eeaf53ec1890ce06771d5d1531
SSDEEP 196608:8ulzUk0J0EIdQ9g8siaOe7rrpWxGau1GFvNKmPtIzZPjTrXBuX3ye:8KzL03ImNDegxs1GFvNKDZPLBuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4188	5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp

Loads dropped DLL 2 IoCs

pid	Process
4188	5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp
4188	5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4188	3960	5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe	90
PID 3960 wrote to memory of 4188	3960	5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe	90
PID 3960 wrote to memory of 4188	3960	5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\is-KE38U.tmp\5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KE38U.tmp\5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp" /SL5="$C003E,8510607,153600,C:\Users\Admin\AppData\Local\Temp\5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KE38U.tmp\5e15074d26b39f6159ce1b3d499a0a40_NeikiAnalytics.tmp
Size 1.1MB
SHA256 4334ba65ebfb6f29ae5d5cda7de30769d7f3fbc18444123c7deaee045e89f9b4
MD5 13e7bcc5769c0bec3da8d16e098c5d08
SHA1 ecbfc91721532e6bcd2b0a650d33fd8fc9dd991d
SHA512 1f710576a6ee7b1c1d345af8432bab64912d9e9944b6ffbf7f113513a737126b8dd9395c7a5084f3f2004792ff147fb7b9a51b3a0ca54fbfced2b55bfe39f835
SSDEEP 24576:O4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx968kYx9uI:jT90guMXEdqwHkU81H
MD5 SHA1 SHA512 SSDEEP

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UQ92O.tmp\_isetup\_isdecmp.dll
Size 13KB
SHA256 e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
MD5 a813d18268affd4763dde940246dc7e5
SHA1 c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA512 b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
SSDEEP 384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3960-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3960-1-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3960-3-0x0000000000401000-0x0000000000412000-memory.dmp

Download

memory/3960-19-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4188-8-0x0000000000400000-0x0000000000533000-memory.dmp

Download

memory/4188-20-0x0000000000400000-0x0000000000533000-memory.dmp

Download

memory/4188-24-0x0000000000400000-0x0000000000533000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads