77168f7ea3de1d57b7ff4d1886a4446e57e662b7375c963f83d6372732c529f0

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:27

Target
512e983143c21a4fea6e83fec10403b0_NeikiAnalytics.exe
Size 74KB
Sample240529-mhdc5abe5v
SHA256 77168f7ea3de1d57b7ff4d1886a4446e57e662b7375c963f83d6372732c529f0
MD5 512e983143c21a4fea6e83fec10403b0
SHA1 f6321699999ba1b8d3ec0e62fd338a77e5da15bb
SHA512 c15756f76a72b16d13d65bb884d4ae6cb59ce1d88a5b7183920456e4c2ad3787061c3f888cf491ee9e19ddbf19bd567e3a96113dd582295c464c68b9d89229c4
SSDEEP 768:hZZ6Zyf9ei1kK4GJrydY8O8oM+9asPW+JXr7QILPcMLopRgVdfbII8CQ7QHt08FW:14K8Y1XVVkgVdrI7Q3FIskXJYI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4744	orsoanuc-ouboas.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\orsoanuc-ouboas.exe	512e983143c21a4fea6e83fec10403b0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\orsoanuc-ouboas.exe	512e983143c21a4fea6e83fec10403b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\512e983143c21a4fea6e83fec10403b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\512e983143c21a4fea6e83fec10403b0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:1868
- C:\Windows\SysWOW64\orsoanuc-ouboas.exe
  "C:\Windows\SysWOW64\orsoanuc-ouboas.exe"
  2⤵
  - Executes dropped EXE
  PID:4744

orsoanuc-ouboas.exe

Path C:\Windows\SysWOW64\orsoanuc-ouboas.exe
Size 71KB
SHA256 3d6ba6da711fb0fc68e8d06731cc185cdecbe6684527527e3597055ea3d596b0
MD5 ce90992d162155716928957311d0b269
SHA1 91e8cf80a1a691d8154bd3dbe19e534e4db2ac0a
SHA512 3bc021b00e44ae98ec8a1e67a94854d9150760c2c545bab537bb397239241d3341a1dd459fecd8ab0ecd6032e88ee6072384f9afba42932ed1e7c4491d3d7c12
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slgM:Olg35GTslA5t3/w8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1868-0-0x0000000077302000-0x0000000077303000-memory.dmp

Download

memory/1868-4-0x0000000000400000-0x0000000000403000-memory.dmp

Download