14f58b1b9bf4a0af1901bf4aca642e3e82a9c81900bce7fa287638a028e8c383

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 06:58

Target

9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe
Size

324KB
MD5

9f72275752cf5f64f40a202dba075120
SHA1

cf7329a13fa9a9e141a1e7d6e7ace5da4db0fa61
SHA256

14f58b1b9bf4a0af1901bf4aca642e3e82a9c81900bce7fa287638a028e8c383
SHA512

004add32de4bbc8da550804c0d6dbdda8d3e6fd11a467e0ee3cd52ae02537a2e91a872845cee58bbd37685c0280304aa261363b6291f15bb1689e301cefa1ad6
SSDEEP

6144:msYSsp5yL23j0Tj4M6aW4I7NMk5B8k3qX/SCm63P8nAO8XZESqAguOSfmiC7smG:msYSsp5R3j0Tj4XaW4I7NM0B9a0dyjLf

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1616	9Zr6wlLi1fJ.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe
2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe
2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1616	2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 1616	2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 1616	2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe	28
PID 2888 wrote to memory of 1616	2888	9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9f72275752cf5f64f40a202dba075120_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\9Zr6wlLi1fJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616

\Users\Admin\AppData\Roaming\{846ee340-7039-11de-9d20-806e6f6e6963}\9Zr6wlLi1fJ.exe

Filesize
72KB

MD5
3fb36cb0b7172e5298d2992d42984d06

SHA1
439827777df4a337cbb9fa4a4640d0d3fa1738b7

SHA256
27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6

SHA512
6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c

Download Submit