Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 07:11

General

  • Target

    26dbe9c6142aef5e3bd89c5837ff3830_NeikiAnalytics.exe

  • Size

    2.0MB

  • MD5

    26dbe9c6142aef5e3bd89c5837ff3830

  • SHA1

    c95076630b21b77ba6e7360369e0df3b4f3333d0

  • SHA256

    fb16141ea139f6a09feb36cd3723598c875b112fafcfd82bdd2e5589c650458d

  • SHA512

    d41b73a3ba3a39fa5da78633224fee1b9af13c81015df845c763dcc64af24a9c015d189296dae3c5c8d9090bd38c5abfd57308305d52bca77604777847c455e2

  • SSDEEP

    49152:h3UR2w5aO12j3mVy88ukVy88uNVy88uDVy88uSVy88uzVy88uhVy88uJVy88uRVo:h36lE2Vy88ukVy88uNVy88uDVy88uSV2

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26dbe9c6142aef5e3bd89c5837ff3830_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\26dbe9c6142aef5e3bd89c5837ff3830_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4656

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\gcapi.dll

          Filesize

          31KB

          MD5

          9339bfe25011d5d5d09f6cfd9f6a36b9

          SHA1

          963bfac19298e16b5485ee2df5f04cdc8ca05a95

          SHA256

          633eb9ac10d46fbc300d5cb1777e9fbc0a5cd3b0a8da6e8b1bb6647a962a1e30

          SHA512

          aa172b03aae57e16bd55d6e893f54cb2fc60001e9c6be6c7c90d91ecdf0e9b20928ac82b84469780eb8cc5292e5a78d2413e14736950b33554c738bdce0c3d43

        • C:\Users\Admin\AppData\Local\Temp\gtapi.dll

          Filesize

          38KB

          MD5

          368922dd93f7249504cce6c52476fd26

          SHA1

          cb81952e2d9327e92045a777b22cd37b838d1018

          SHA256

          d98c796b0d205b7537a864f696f7639ba301ce0330cb82a0b0234813a3d78fda

          SHA512

          33d812422981d09fd267f9a2b43bdf873110deff5633c74fd6ec9858db1a9638550bf8e0b3bd94c299a1c12e7fa2a0ae8a28b8e79ccae471a252268ac20a6a7c

        • memory/4656-1-0x0000000000400000-0x00000000005FE000-memory.dmp

          Filesize

          2.0MB

        • memory/4656-7-0x0000000074A40000-0x0000000074A58000-memory.dmp

          Filesize

          96KB

        • memory/4656-13-0x0000000074790000-0x00000000747A7000-memory.dmp

          Filesize

          92KB

        • memory/4656-14-0x0000000000400000-0x00000000005FE000-memory.dmp

          Filesize

          2.0MB

        • memory/4656-15-0x0000000074A40000-0x0000000074A58000-memory.dmp

          Filesize

          96KB

        • memory/4656-16-0x0000000074790000-0x00000000747A7000-memory.dmp

          Filesize

          92KB