c0ecb2795d7954d85ed1a7c152d03d2ae6e6e0f4db5f749d41081d9c5a4f02aa

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:18

Target
a3357046aeffba095de31e3878931890_NeikiAnalytics.exe
Size 73KB
Sample240603-pgvl5afd52
SHA256 c0ecb2795d7954d85ed1a7c152d03d2ae6e6e0f4db5f749d41081d9c5a4f02aa
MD5 a3357046aeffba095de31e3878931890
SHA1 07fd71769426cd71d25b018d6cfac44ecee3818e
SHA512 e55e920b67e2a68fc6147de09c8b3762ef5d768d10466694fec4fee2787dd9dbfbc927c6b28d4e26a37fa2e5d13e0737862688f29697d17c9c6e5b7557d49210
SSDEEP 1536:hbSW6pBtxAOVDADK5QPqfhVWbdsmA+RjPFLC+e5hB0ZGUGf2g:hyBY2sDNPqfcxA+HFshBOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3316	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3248	3144	a3357046aeffba095de31e3878931890_NeikiAnalytics.exe	84
PID 3144 wrote to memory of 3248	3144	a3357046aeffba095de31e3878931890_NeikiAnalytics.exe	84
PID 3144 wrote to memory of 3248	3144	a3357046aeffba095de31e3878931890_NeikiAnalytics.exe	84
PID 3248 wrote to memory of 3316	3248	cmd.exe	85
PID 3248 wrote to memory of 3316	3248	cmd.exe	85
PID 3248 wrote to memory of 3316	3248	cmd.exe	85
PID 3316 wrote to memory of 1064	3316	[email protected]	86
PID 3316 wrote to memory of 1064	3316	[email protected]	86
PID 3316 wrote to memory of 1064	3316	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\a3357046aeffba095de31e3878931890_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a3357046aeffba095de31e3878931890_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1064

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 6f3229b3402bb1b7ec4909a35f8d7432f406367a18f1c7f121ebb17a44b745fd
MD5 1e05599085fc49fd8f862e20b29b8882
SHA1 7b091ef47917e0f557aa8f28a0584a097b26a649
SHA512 3cd9c127c6b2811a915206390483811d40e9eaca7e08291384714bd265a51d2dd6a6e5875bea754c8e27294d837a43da0ce6043006ea19097e0e91ef23668145
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5ht0ZGUGf2g:hGYvHNPqfcxA+HFshtOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/3144-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3316-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download