42f8f51d2e43f3338da93d7eceef28e6e1d0225aa5cf5e0c3110cc3cd6e8c6aa

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 07:40

Target

4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe
Size

324KB
MD5

4b1d2331f7066579245f50ed49e1a040
SHA1

79404882808b2929c4c805eb9395e05002f73c0a
SHA256

42f8f51d2e43f3338da93d7eceef28e6e1d0225aa5cf5e0c3110cc3cd6e8c6aa
SHA512

2650495aeca1a092f4002f8626610b8c5adef29a1f7e881b2fcedbc799f36cbbc33ddc85ad093ad259fb91de9350b0d75593741dc6f264cf4b976f2ccb309550
SSDEEP

6144:msYSsp5yL23j0Tj4M6aW4I7NMk5B8k3qX/SCm63P82AO8XzESqAguOSfmiCgsmG:msYSsp5R3j0Tj4XaW4I7NM0B9a0Iy9LQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2412	noV1N289Vl6Xp.exe

Loads dropped DLL 1 IoCs

pid	Process
2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe
2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe
2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2412	2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe	28
PID 2300 wrote to memory of 2412	2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe	28
PID 2300 wrote to memory of 2412	2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe	28
PID 2300 wrote to memory of 2412	2300	4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b1d2331f7066579245f50ed49e1a040_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\noV1N289Vl6Xp.exe
  2⤵
  - Executes dropped EXE
  PID:2412

\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\noV1N289Vl6Xp.exe

Filesize
72KB

MD5
3fb36cb0b7172e5298d2992d42984d06

SHA1
439827777df4a337cbb9fa4a4640d0d3fa1738b7

SHA256
27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6

SHA512
6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c

Download Submit