096d0d5771ab64234aa74975f3710bdeef40f3afc361405fe19b7409f6aca77c

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 04:04

Target

3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe
Size

108KB
MD5

3194fb56ca4c6a18c012357bc90b4320
SHA1

938b03d6aaf3f81ee465e953e37fea38fe436a0f
SHA256

096d0d5771ab64234aa74975f3710bdeef40f3afc361405fe19b7409f6aca77c
SHA512

deed5838102e2b0b9dfa49cda81fe711d1e24bb1a890014d7f26db9f5b45803b9dc3ebbb51e6ccbdb0b095d2aaa1eccdce3e97a52cbfbe6541651e9821fd313a
SSDEEP

3072:i+Oa8AFGusZI5e+Mp+BC3K5eqU+BC3K5eqYro+X:NIAFG3IaDK70K7qX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2096	dbilzqh.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\dbilzqh.exe	3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	dbilzqh.exe
Token: SeDebugPrivilege	1204	Explorer.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2096	1708	taskeng.exe	29
PID 1708 wrote to memory of 2096	1708	taskeng.exe	29
PID 1708 wrote to memory of 2096	1708	taskeng.exe	29
PID 1708 wrote to memory of 2096	1708	taskeng.exe	29
PID 2096 wrote to memory of 1204	2096	dbilzqh.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
- C:\Users\Admin\AppData\Local\Temp\3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2868

C:\Windows\system32\taskeng.exe
taskeng.exe {73E7A09F-8590-4950-BA70-65B585CBB836} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\PROGRA~3\Mozilla\dbilzqh.exe
  C:\PROGRA~3\Mozilla\dbilzqh.exe -kwinamg
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2096

C:\PROGRA~3\Mozilla\dbilzqh.exe

Filesize
108KB

MD5
c021377c8c8a45eac12c5df2be15b5d7

SHA1
8a5df09859199bcf1eb6d6c90f4070ecb33578b2

SHA256
9f10c83b0a210b7dff3d41ac09d1649459c89283f157d67c3076d612409ab639

SHA512
9e4fc54f8e6c72a87d67d2aaf8838638162edf1134edae96d0e0b702ff61d50275ac1682aba31bcea06248a8f3f3e4b21f2e1de9adbc8796ed61b30fff5c37a3

Download Submit
memory/1204-4-0x0000000002560000-0x000000000257C000-memory.dmp

Filesize
112KB

Download
memory/1204-3-0x0000000002560000-0x000000000257C000-memory.dmp

Filesize
112KB

Download