Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31/05/2024, 05:26
General
-
Target
7908a5a57679ff8750e830117d3cc210_NeikiAnalytics.exe
-
Size
6.8MB
-
MD5
7908a5a57679ff8750e830117d3cc210
-
SHA1
427adb5085d923e052d67d5cdf2f9a80e5d31b4e
-
SHA256
2994fb7a2291f18ae8728aa34c3000e39445dba60e5a0139996c3415d2e08077
-
SHA512
62cb81ee669147e910adbcb102d8191db1095c2a6229d6227a83b4357c86118e4769bba0b8c0f81cabb559108a51a4c8e63f2d4fb509fd90b83a6d3f7dabf3b5
-
SSDEEP
196608:q9WjprsKC01zn9q5/pbaEPKy+ALhcBgxEo6akx:q9W3zn4zb3FLaBoFc
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7908a5a57679ff8750e830117d3cc210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7908a5a57679ff8750e830117d3cc210_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 6642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 6642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1948 -ip 19481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1948 -ip 19481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
436KB
-
Filesize
436KB