6811e5666368ffe7ad71d8a43260f117b776b3b151c8ae882494a260771aab72

Analysis

max time kernel
142s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:46

Target
6a36638650b9106593bed786aa9b1340_NeikiAnalytics.exe
Size 61KB
Sample240613-jmdynstepk
SHA256 6811e5666368ffe7ad71d8a43260f117b776b3b151c8ae882494a260771aab72
MD5 6a36638650b9106593bed786aa9b1340
SHA1 bc21391f6d1348fdf46e205d604015a5cd88646c
SHA512 c08376d7d1588d65c24d92735d33f05f132fd34453db88182b0b8403280695fcf685d6ed1fffe46368802f9eb41bf237417a295d6594b97e2a8308a094119f4d
SSDEEP 768:NeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:NQIvEPZo6Ead29NQgA2wzle5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 3 IoCs

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4908	4276	6a36638650b9106593bed786aa9b1340_NeikiAnalytics.exe	81
PID 4276 wrote to memory of 4908	4276	6a36638650b9106593bed786aa9b1340_NeikiAnalytics.exe	81
PID 4276 wrote to memory of 4908	4276	6a36638650b9106593bed786aa9b1340_NeikiAnalytics.exe	81
PID 4908 wrote to memory of 2436	4908	ewiuer2.exe	89
PID 4908 wrote to memory of 2436	4908	ewiuer2.exe	89
PID 4908 wrote to memory of 2436	4908	ewiuer2.exe	89
PID 2436 wrote to memory of 404	2436	ewiuer2.exe	90
PID 2436 wrote to memory of 404	2436	ewiuer2.exe	90
PID 2436 wrote to memory of 404	2436	ewiuer2.exe	90

C:\Users\Admin\AppData\Local\Temp\6a36638650b9106593bed786aa9b1340_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a36638650b9106593bed786aa9b1340_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      C:\Users\Admin\AppData\Roaming\ewiuer2.exe
      4⤵
      Executes dropped EXE
      PID:404

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 e5125c7b48711b2f31789a202fb3b5634caef681c02607075f2265f00c274c6f
MD5 14632be43a340e0609f74cdc565e2194
SHA1 bdd5c506173237d1af311ae0f0b6edee538a77c0
SHA512 b802c8cc7f5520cb7a5250084abe726b11f8f928c669ee863c4e152b3d714ce93dc44a4f8b3cb4a4057703c48b0e67b0d5456df51a47c7be4ab42e755d0cebea
SSDEEP 768:PeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:PQIvEPZo6Ead29NQgA2wzle5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path C:\Users\Admin\AppData\Roaming\ewiuer2.exe
Size 61KB
SHA256 879f7edb9e688c4bf1e081518e8af65e5348e8ce7a22bde3c31edbe504415550
MD5 76ea546bfaeadb375d983011b6d9ca41
SHA1 5b3a2082a589d119c952d1b5836d71a185095999
SHA512 91218d43afba3b5a8ff51dec5f5d55f6ae7920afc432868f13867bdb4d23a28d5f61942a341f7b05082a3b11e6adf4ec251a77c44fe80dfa63f9360db6f9b7cd
SSDEEP 768:JeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:JQIvEPZo6Ead29NQgA2wzle5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewiuer2.exe

Path C:\Windows\SysWOW64\ewiuer2.exe
Size 61KB
SHA256 576fa1bc43323ab37f1fc0a6bb2de21fcbb7bab9e222f9a75b1458e2c5a59c5e
MD5 26eb5a550597b21b7ab15451c1ac368d
SHA1 7e487fd125678061cf02a830d0c8da320ab824cf
SHA512 09ba4567bde5f545687e60a75c40b70fffcb49ce5b274e21fe868c73a55b91260e1c37af066bea1d55e7689859369fff79fff501dd72220c23e08fc472860036
SSDEEP 768:XeJIvFKPZo2smEasjcj29NWngAHxcwKppEaxglaX5uA:XQIvEPZo6Ead29NQgA2wzle5
MD5 SHA1 SHA512 SSDEEP

Submit Download