fb58202c2e3fc4688eb35338607e0214600d615a6806817babe348eeae7464e2

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 22:11

Target

0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe
Size

66KB
MD5

0c1f8c6ccb2fb78fcd4d9d55c25538e0
SHA1

0c67a86b06d3fe2559373a69c4ffe4498fdef36c
SHA256

fb58202c2e3fc4688eb35338607e0214600d615a6806817babe348eeae7464e2
SHA512

78d507417f4aea3e00a3ffacdaa4c19e017f9fef8dc33ebe2820ea34b40f7b0b44dc7ad6ea63b3b5c1468419c6126dcc6e492f7aefa163a64bff877f38af8160
SSDEEP

768:iLxqBt1sJw5pVNUP1/kvtbWcpmCKXHak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKp0:1teqYQIXJJyXEv/MBK6vRel1QwI

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2928	idtekeatú±¬±
2808	idtekeatú±¬±

Loads dropped DLL 3 IoCs

pid	Process
2872	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe
2872	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe
2928	idtekeatú±¬±

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\idtekeatú±¬±	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\obxovodú°¸¸	idtekeatú±¬±
File created	C:\Windows\SysWOW64\obxovodú°¸¸	idtekeatú±¬±
File opened for modification	C:\Windows\SysWOW64\idtekeatú±¬±	idtekeatú±¬±
File opened for modification	C:\Windows\SysWOW64\idtekeatú±¬±	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2928	2872	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe	28
PID 2872 wrote to memory of 2928	2872	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe	28
PID 2872 wrote to memory of 2928	2872	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe	28
PID 2872 wrote to memory of 2928	2872	0c1f8c6ccb2fb78fcd4d9d55c25538e0_NeikiAnalytics.exe	28
PID 2928 wrote to memory of 2808	2928	idtekeatú±¬±	29
PID 2928 wrote to memory of 2808	2928	idtekeatú±¬±	29
PID 2928 wrote to memory of 2808	2928	idtekeatú±¬±	29
PID 2928 wrote to memory of 2808	2928	idtekeatú±¬±	29

C:\Windows\SysWOW64\obxovodú°¸¸

Filesize
5KB

MD5
48c45e05569f9a5665d082fbdc116c14

SHA1
e491ab1327b88312fc6d0535621b6de733c8efb5

SHA256
7e916f847bb5de3e09b36bd527e09ed656df13296bdcd9924185bcccde7dbe4c

SHA512
e1cc47e185831dc6c40372efc227f299964f262c641b790d31f0fe452a5bc70a4946c689913504c64790833c131d40c01fcd9ff3a148636be9f502959f7cc49c

Download Submit
\Windows\SysWOW64\idtekeatú±¬±

Filesize
66KB

MD5
0c1f8c6ccb2fb78fcd4d9d55c25538e0

SHA1
0c67a86b06d3fe2559373a69c4ffe4498fdef36c

SHA256
fb58202c2e3fc4688eb35338607e0214600d615a6806817babe348eeae7464e2

SHA512
78d507417f4aea3e00a3ffacdaa4c19e017f9fef8dc33ebe2820ea34b40f7b0b44dc7ad6ea63b3b5c1468419c6126dcc6e492f7aefa163a64bff877f38af8160

Download Submit
memory/2808-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2872-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2928-28-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download