Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 06:54

General

  • Target

    9f58fc6abb2e9588bc0d91724359f220_NeikiAnalytics.exe

  • Size

    9.5MB

  • MD5

    9f58fc6abb2e9588bc0d91724359f220

  • SHA1

    99d5c7b62efc015e2cfa691ccf86fa361eb349fe

  • SHA256

    407b5222e70cef2d9a9c708ce200bb394f00bc344a5bf6a99fee9e19fdeaeb4a

  • SHA512

    0d3aecb9aa59d807fe8e80091aae5eafc6e486888f21cea63ec456c19403da317b820b55c008c955d2bdb9d0889ba6d58f236743f21eb3ff9d6e39b376154b7e

  • SSDEEP

    98304:rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGs:v

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f58fc6abb2e9588bc0d91724359f220_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9f58fc6abb2e9588bc0d91724359f220_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    PID:1460
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    9.7MB

    MD5

    4a12bdc663f57873e834312deaac44a9

    SHA1

    a00975051fa93209280281c4388f764aa2ccd3b6

    SHA256

    203e491625d32ad875a11b09975e93ee8b0f0675b8e3d66476f5bcf39a9f3db5

    SHA512

    c9a1fd8b029d0e86b6c151ea10293d3a30267cc1f745956ce347cb81b2aaf505c24ca8143899f96ff907797a1d7c5da2b7ae0cd0399f68fd14d5c6541294b7c3

  • memory/1460-2-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1460-1-0x00000000003B0000-0x00000000003B5000-memory.dmp

    Filesize

    20KB

  • memory/1460-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1460-8-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2932-5-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/2932-7-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB