e031cd1d32b778c2e54d00da8c8152377f21b43a1520a60458447c04cb39d4c7

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 09:20

Target
4ef280122a3cac08797ea0798628a430_NeikiAnalytics.exe
Size 73KB
Sample240529-la8cvshh71
SHA256 e031cd1d32b778c2e54d00da8c8152377f21b43a1520a60458447c04cb39d4c7
MD5 4ef280122a3cac08797ea0798628a430
SHA1 d31086c626c93d7aa19f88648d4fa7d20472a0fa
SHA512 b9746b90c7be4e5ccca450d1e925c3921435a8436eceb63be35bb2c51e481d87187e9d2fe5f082433c5427866fe5b98a9ce0009c64597bd10d28195fabd810a1
SSDEEP 1536:hbLWt0pG7PK5QPqfhVWbdsmA+RjPFLC+e5hy0ZGUGf2g:hZAPNPqfcxA+HFshyOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2912	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3224	4180	4ef280122a3cac08797ea0798628a430_NeikiAnalytics.exe	92
PID 4180 wrote to memory of 3224	4180	4ef280122a3cac08797ea0798628a430_NeikiAnalytics.exe	92
PID 4180 wrote to memory of 3224	4180	4ef280122a3cac08797ea0798628a430_NeikiAnalytics.exe	92
PID 3224 wrote to memory of 2912	3224	cmd.exe	93
PID 3224 wrote to memory of 2912	3224	cmd.exe	93
PID 3224 wrote to memory of 2912	3224	cmd.exe	93
PID 2912 wrote to memory of 3820	2912	[email protected]	94
PID 2912 wrote to memory of 3820	2912	[email protected]	94
PID 2912 wrote to memory of 3820	2912	[email protected]	94

C:\Users\Admin\AppData\Local\Temp\4ef280122a3cac08797ea0798628a430_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ef280122a3cac08797ea0798628a430_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
1⤵
PID:4804

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 ca3fe5cc248712dbeae9ac10acf1f5d24ef2e4fde86dd824bde564c926890edc
MD5 e1566207b936aa137e097767a4fe3985
SHA1 81f5bff69201f5d625bc320aa247e6542b4e76d6
SHA512 f2e0e35905afe162978faeb4befd2df6c70775e1e2f7566110cc65435915aac0ce173508037e95ada45518480360e50b7142cf006484be872471efa4147a7485
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hs0ZGUGf2g:hGYvHNPqfcxA+HFshsOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/2912-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4180-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download