4d715045053edae69d62eeebc0f56be5d390933b3fa1323da9d1b83ffef3fd94

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:35

Target
a2014aec1c20e2eb319ece55a2b7a030_NeikiAnalytics.exe
Size 79KB
Sample240603-np7e8aec92
SHA256 4d715045053edae69d62eeebc0f56be5d390933b3fa1323da9d1b83ffef3fd94
MD5 a2014aec1c20e2eb319ece55a2b7a030
SHA1 5c365e630ac46ec67d93d9c1d47122ea1e131667
SHA512 38752a78464a9c026ae9c41412aefe6ac65535d723580e5be54ffeedeb49ef9126d56c7edf9db8c0beccae9c8a3284a4e6e4a0ebe30890263e674548e63e2949
SSDEEP 1536:zvSPRRRf384f0+zOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zv0RRRfZfQGdqU7uy5w9WMyBN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2860	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2316	4856	a2014aec1c20e2eb319ece55a2b7a030_NeikiAnalytics.exe	91
PID 4856 wrote to memory of 2316	4856	a2014aec1c20e2eb319ece55a2b7a030_NeikiAnalytics.exe	91
PID 4856 wrote to memory of 2316	4856	a2014aec1c20e2eb319ece55a2b7a030_NeikiAnalytics.exe	91
PID 2316 wrote to memory of 2860	2316	cmd.exe	92
PID 2316 wrote to memory of 2860	2316	cmd.exe	92
PID 2316 wrote to memory of 2860	2316	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\a2014aec1c20e2eb319ece55a2b7a030_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a2014aec1c20e2eb319ece55a2b7a030_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:1128

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 08a4d76fd40172754ed446a37b107b6d90ee7304c57001d14c7b95d5808b9279
MD5 1ad1297aed64be1c10621f8efde956df
SHA1 dea6aa4e58c1a220f628bad4399868bae8875cff
SHA512 f8ab2205dd98145ba099fda408a7d6bbef36c132a5396211d9804080d8288318f2efc4e4ca2263159d7202769562b772edd0665961dd1defef6e2d42b0b7e240
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ypB8GMGlZ5G:zv+vTpGdqU7uy5w9WMypN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2860-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4856-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download