1f7ac6781eecca404f259bfae2414bb3166e793fd813f1c516e00f67920a930a

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 03:26

Target

75257df14d85327070853f62b65149a0_NeikiAnalytics.exe
Size

73KB
MD5

75257df14d85327070853f62b65149a0
SHA1

b95ffdee8a154b78d637d8b85893470d510d3c21
SHA256

1f7ac6781eecca404f259bfae2414bb3166e793fd813f1c516e00f67920a930a
SHA512

f16e650cae4d118d68250db3dd672064afd2f3fec7550a0211ec4a74b2defc849ec668cb0df29c2f435cdaf8b7b11e86e18b4eaacccad6e51a2309f393ae110f
SSDEEP

1536:hbjTH6vk9STK5QPqfhVWbdsmA+RjPFLC+e5h30ZGUGf2g:hnTHOk9gNPqfcxA+HFsh3Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4384	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4532	3000	75257df14d85327070853f62b65149a0_NeikiAnalytics.exe	91
PID 3000 wrote to memory of 4532	3000	75257df14d85327070853f62b65149a0_NeikiAnalytics.exe	91
PID 3000 wrote to memory of 4532	3000	75257df14d85327070853f62b65149a0_NeikiAnalytics.exe	91
PID 4532 wrote to memory of 4384	4532	cmd.exe	92
PID 4532 wrote to memory of 4384	4532	cmd.exe	92
PID 4532 wrote to memory of 4384	4532	cmd.exe	92
PID 4384 wrote to memory of 4292	4384	[email protected]	93
PID 4384 wrote to memory of 4292	4384	[email protected]	93
PID 4384 wrote to memory of 4292	4384	[email protected]	93

C:\Users\Admin\AppData\Local\Temp\75257df14d85327070853f62b65149a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\75257df14d85327070853f62b65149a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
5b7a2e853af74634608e6ed153acab35

SHA1
560a2dc00ede2b419fd4de01141bb4b529cceaf6

SHA256
daa87c31f92eeb54811ccbda59bcd1eb73fb425376435a33b1d65f359591fac2

SHA512
4a6b0d37d814b0a85a97e5223ca78dec2b1627b8c38f72211960ad83adc405d9af39b45dfd7c2df0df9fbd7dcba6913da611a440706c9f3c55a8c32cba49ab31

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/3000-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4384-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download