209d16a2fa446d0ff2bda16e29ffdfe26a0b15eef3d11ceb98f0f10bf306f946

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 14:44

Target

0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe
Size

73KB
MD5

0a43a5c92b5fa18c42dbf2cab51d54a0
SHA1

b6f6eca622b7b9b5e51cd3d9fcbd5b7535f40027
SHA256

209d16a2fa446d0ff2bda16e29ffdfe26a0b15eef3d11ceb98f0f10bf306f946
SHA512

a8310b6153eabc28f5894891121a6d18b4693d001779503291d798c336b972870e46e1ae5ae40430688b9401db89db3787f7dc8a59d70a1c3b782e525a05c2e3
SSDEEP

1536:hb3jkiqsPeqK5QPqfhVWbdsmA+RjPFLC+e5hS0ZGUGf2g:hPkixPeqNPqfcxA+HFshSOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4052	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 4332	836	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	84
PID 836 wrote to memory of 4332	836	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	84
PID 836 wrote to memory of 4332	836	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	84
PID 4332 wrote to memory of 4052	4332	cmd.exe	85
PID 4332 wrote to memory of 4052	4332	cmd.exe	85
PID 4332 wrote to memory of 4052	4332	cmd.exe	85
PID 4052 wrote to memory of 2896	4052	[email protected]	86
PID 4052 wrote to memory of 2896	4052	[email protected]	86
PID 4052 wrote to memory of 2896	4052	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2896

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
4c1bff623b6ca96445d497df6cf88e8d

SHA1
9dc0bf0b3e3c39d35698db804c0f5b3d7e5d2430

SHA256
adb55146396d25becc8d385bc7b54f08850024ceac8c23db906163bca6a0ea56

SHA512
a79b6c9759b115d3001a3284eff20668699a19fce1b609c0bc5c2a8d88c6406480e1e236ceba53dfb43530f7e6a1b71c1c7035242f8a8a87fb270d7180354141

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/836-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4052-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download