Analysis

  • max time kernel
    130s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 23:34

General

  • Target

    246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

  • Size

    59KB

  • MD5

    f93578bd6bebe2b5f8825db989cca1a0

  • SHA1

    dd1f0779ad4af9a5847d3b55a94803bab73d8788

  • SHA256

    246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538

  • SHA512

    a6e9c65ea4d3056b988a43bbf125edc7e32172d5ded1a8c0ab3ee9ede4547f8d3e16ae70c42b40f04bea66a8a9cfc4b6ba04735192dab0a04ee43d9ae6131448

  • SSDEEP

    768:HZgO6moL8ifXzCknHwgHbH84J7bPBLszy2Y/nnXvvJ1GS7jc0uWEJ8/r+j58GQ:5gODivrnHFvJ71aMfBR7LEJ8w5

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

    Filesize

    59KB

    MD5

    a54d67a6f6f8a07d0905aefd386ab246

    SHA1

    a6e2b2fce4925fccf51fe78efc0fc245beb13621

    SHA256

    38c36f75c39964e9e186cedcd8a311aadcd054d858f385c0b2bcaeac55106317

    SHA512

    b1e150b4d8deffbb625f7f5600e0330ed42213c35474c267e6015e2ed8e4aa4a97496591ac01121a81be1779a17ad0d68f72443ceefb3f780ed6c4d5636f230f

  • memory/2120-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2120-1-0x00000000001B0000-0x00000000001BF000-memory.dmp

    Filesize

    60KB

  • memory/2120-2-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2120-12-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/3888-13-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/3888-14-0x0000000000190000-0x000000000019F000-memory.dmp

    Filesize

    60KB

  • memory/3888-16-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/3888-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3888-25-0x0000000004D70000-0x0000000004D8D000-memory.dmp

    Filesize

    116KB

  • memory/3888-26-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB