Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 09:23

General

  • Target

    4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe

  • Size

    7.5MB

  • MD5

    4f0b17d2b23a5c668e50a8c95079bba0

  • SHA1

    bb9475598efddd38f177ef8131ff243c162deef5

  • SHA256

    a21086776cba10e3ca93ad3d96b08fab8c131869a14819c9d88af601fd5e97c7

  • SHA512

    ce7e8b432e6e426344dc54fd06235084f65c25ad4ef2aaed43ef5f0c5c6d41b6b79031e5c97115cf92b67feb6d9fc7dc2833476555a8e76336d83d62eea9198e

  • SSDEEP

    196608:i7u+sxfCurErvI9pWjgU1DEzx7sKL/s1tYAkjrWlRHes:PXxfCurEUWjhEhn01t+49

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\4f0b17d2b23a5c668e50a8c95079bba0NeikiAnalytics.exe"
      2⤵
      • Loads dropped DLL
      PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI18882\python312.dll

    Filesize

    1.8MB

    MD5

    cbd02b4c0cf69e5609c77dfd13fba7c4

    SHA1

    a3c8f6bfd7ffe0783157e41538b3955519f1e695

    SHA256

    ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5

    SHA512

    a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567

  • memory/2504-23-0x000007FEF5E50000-0x000007FEF6529000-memory.dmp

    Filesize

    6.8MB