28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:06

Target

28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe
Size

29KB
MD5

924368dd4c4035e6eb408b573d712550
SHA1

ebca3e4e0eb097c78fb978a2a9e72a8d0301aa8a
SHA256

28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf
SHA512

be6cd25b0d5a159a270dad989a8283672dbb9b46417e143821103c6f89ab7f89016fc38a2ec72ffd8ef7e73efd7977264a511a8dee486b9c1f54ee80be4fea30
SSDEEP

384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXLV:v/qSamrxDmqoKM4Z0iwtwALV

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2544	2024062600.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe
2544	2024062600.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2544	812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe	80
PID 812 wrote to memory of 2544	812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe	80
PID 812 wrote to memory of 2544	812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe	80
PID 812 wrote to memory of 4784	812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe	81
PID 812 wrote to memory of 4784	812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe	81
PID 812 wrote to memory of 4784	812	28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\28b7a69ec332b640b6c5e949fe8b3faff22df02eba21d200b597d2cd30bc0edf_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\2024062600.exe
  C:\Users\Admin\AppData\Local\Temp\2024062600.exe down
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
  2⤵
  PID:4784

C:\Users\Admin\AppData\Local\Temp\2024062600.exe

Filesize
29KB

MD5
06a32004e65751e85e3d6d267bbeaa0f

SHA1
3e6785b8a71c9a91a8c4616fdf34ac9ecbf06853

SHA256
8ad02c3af72e01f95b2f11f230d0b416a2ed075f8744ebf5302c1eec8302314d

SHA512
f2b649e3056aded0e7ab63a79b5ea9712878683f4189d022b14775601554157c3a25810fa182a3cfdb4a0d9a7153dae97ba648eca5ddaf7172f2871f326a5d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
312B

MD5
f53d2403ecfabfb64b43a11654f5a8a4

SHA1
bb95e77a437ee2c9607c448e66c7a8b084436d5b

SHA256
bc599f06082cea12541b3bbb8fc461cc1a004fa2f6e8a66dd682d00b92934b88

SHA512
f8889b18b472ae558302f2c9c68e4ca16b91d2ffc22e7c8a57681a23adae233ba4d0fdaf525fdf8ee6eacfd1d6adc86e5efcd1d4a61ae7ab075b265e5e1d2c0f

Download Submit
memory/2544-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download