30cbaf00d0f0a089aa1ec8b1d0de6818700552abcbec12e9061900d9e899278d

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95b00bcf2332452a8c81743ed53d0110_NeikiAnalytics.exe
Size 208KB
Sample240614-bfgf8ayfka
SHA256 30cbaf00d0f0a089aa1ec8b1d0de6818700552abcbec12e9061900d9e899278d
MD5 95b00bcf2332452a8c81743ed53d0110
SHA1 11f4aeee69f3a68427963872a4268b59b98ef551
SHA512 3854abc536b41d05ee5351a284f6ef9ca7b57e9b591d67d680e0b4300f2ca26fe258e4b0e3e6848bc2078ea9f9b2ef118551549dba7d3580213df5863e11bd98
SSDEEP 6144:EV08GTt10O5kYdo3arG10pa5LflmXBBqyLCchv:EVa30O5kYkIXfqyLCcx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 3356	1408	95b00bcf2332452a8c81743ed53d0110_NeikiAnalytics.exe	86
PID 1408 wrote to memory of 3356	1408	95b00bcf2332452a8c81743ed53d0110_NeikiAnalytics.exe	86
PID 3356 wrote to memory of 3512	3356	csc.exe	87
PID 3356 wrote to memory of 3512	3356	csc.exe	87

C:\Users\Admin\AppData\Local\Temp\95b00bcf2332452a8c81743ed53d0110_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\95b00bcf2332452a8c81743ed53d0110_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dwilfr2f\dwilfr2f.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C95.tmp" "c:\Users\Admin\AppData\Local\Temp\dwilfr2f\CSCC7D9A456E5324C1FA3A755DBFE8E36B7.TMP"
    3⤵
    PID:3512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RES6C95.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6C95.tmp
Size 1KB
SHA256 9a01f5c6da1bdc542672a518ff0473efbe6c7d1b38bc38e76d511608cb8cb38f
MD5 c5cbfab926e6f184092528744eda299b
SHA1 1b25be83d1f7263b40ab1ceb367e9f8cbc21007f
SHA512 a9315a4fd85f51c2528f72b76a2327ebf633e249315cfe3ada81c15027209e5191001859cf558dd756e0b973dc5cbbf11fe3b3fd7e5e9fc38adce8e083cd208b
MD5 SHA1 SHA512

Submit Download

dwilfr2f.dll

Path C:\Users\Admin\AppData\Local\Temp\dwilfr2f\dwilfr2f.dll
Size 4KB
SHA256 4a898df5adbccbf7bdfca089d0c6ba5feef6560387208c9e8e2d21ccebc1b209
MD5 929a6cea9aa594c593ec42a477778dd7
SHA1 ef81372df16e83b3eedf58ee1d706826d9af9d20
SHA512 ccd87e6eb0d549165b0531dcf37e50e85e8c22aada4a84e360835541292b023b527e2d472b65fc24cb3d6daad284f81b327b04a53e8b9d21cf04c609bee466ca
MD5 SHA1 SHA512

Submit Download

CSCC7D9A456E5324C1FA3A755DBFE8E36B7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dwilfr2f\CSCC7D9A456E5324C1FA3A755DBFE8E36B7.TMP
Size 652B
SHA256 1afe562726ccdeec881b35e3baefc4203565236c936779adea9f7a9617161b08
MD5 4e2f92c028e196af768d405d84fda606
SHA1 b0a13c03729d27bb3715b695d13c61a9b1cb137d
SHA512 d2a1338cba64c29db71dc75bc02d575d89b85632044039d10d4b21f9c8f3896afa419c78043ccdec6a16ff0e6298af63ec906f9b2d886ea8ef203201ba56b102
MD5 SHA1 SHA512

Submit Download

dwilfr2f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dwilfr2f\dwilfr2f.0.cs
Size 1KB
SHA256 dfb6ab38744b3a4e17cf7fa75b3126e88cbeabc907008f3921ff41c523a99a27
MD5 f420ebb3150f0764331a33377a7451b8
SHA1 8ed9b9d610e8ab76aea82a3830ad31059517630b
SHA512 b92767736261cb7c10f58576c44e62cd0d105e90e139b376d52ccb5cb7ca189205a1f7d7a5fec5d739f8763eded8b5c55b9057217fe9a55b1e151dc700760cbd
MD5 SHA1 SHA512

Submit Download

dwilfr2f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dwilfr2f\dwilfr2f.cmdline
Size 208B
SHA256 fbc5df1baa28555e9c5e407f0202040a78a28f3071192d5208059f6381d5453f
MD5 80dbe1b1660dc0156fc52349de7f67d4
SHA1 84a357692a0f97e9a8eabd731bac7b07b0a05502
SHA512 fd5e0d99494a6386645c1240664f9240eb0dfc9a366d8f4724091ed70c0b28db45f2051d2f89ffd318592ced7301a91f46ffe72725dd36668f53fae636492dd6
MD5 SHA1 SHA512

Submit Download

memory/1408-11-0x00007FFE832E3000-0x00007FFE832E5000-memory.dmp

Download

memory/1408-18-0x00007FFE832E0000-0x00007FFE83DA1000-memory.dmp

Download

memory/1408-12-0x0000018D916E0000-0x0000018D916E8000-memory.dmp

Download

memory/1408-19-0x00007FFE832E0000-0x00007FFE83DA1000-memory.dmp

Download

memory/1408-0-0x0000018D915F0000-0x0000018D915F1000-memory.dmp

Download

memory/1408-10-0x00007FFEA16F0000-0x00007FFEA18E5000-memory.dmp

Download

memory/1408-9-0x0000018D915F0000-0x0000018D915F1000-memory.dmp

Download

memory/1408-30-0x00007FF7B1D30000-0x00007FF7B1D6D000-memory.dmp

Download

memory/1408-27-0x0000018D92F50000-0x0000018D92F58000-memory.dmp

Download

memory/1408-31-0x00007FFE832E0000-0x00007FFE83DA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads