01f4f09c948a200ca774635396fac7e13b482f0ddb9687085d7ad501761162e1

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 21:37

Target

01f4f09c948a200ca774635396fac7e13b482f0ddb9687085d7ad501761162e1_NeikiAnalytics.exe
Size

1.4MB
MD5

53db161038fbe36c297bc5dd9c2c6970
SHA1

a1726649c6ab34d0f8c029648f11c57ab90b1bba
SHA256

01f4f09c948a200ca774635396fac7e13b482f0ddb9687085d7ad501761162e1
SHA512

45223ec6a4d42fec262f78b3e4d7ff61e0c4a8165061fd8578a53196bd30c1137b70d17e6e3f487419cc919c3a9fae2f6fd90c62a9bebc83984efee3c9583ebb
SSDEEP

24576:FnyH50JIUwHdnJj77diUvq/Ph8eMpZTuDYjsRSHhKDCs6taaGdTgvc7/3PaV/A:Fnq9JLg/P6j18Cs6czTqA/CV/

Score

7^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000800000002325a-2.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2332	01f4f09c948a200ca774635396fac7e13b482f0ddb9687085d7ad501761162e1_NeikiAnalytics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x000800000002325a-2.dat	upx
behavioral2/memory/2332-5-0x0000000010000000-0x000000001007E000-memory.dmp	upx
behavioral2/memory/2332-7-0x0000000010000000-0x000000001007E000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\01f4f09c948a200ca774635396fac7e13b482f0ddb9687085d7ad501761162e1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\01f4f09c948a200ca774635396fac7e13b482f0ddb9687085d7ad501761162e1_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:4896

C:\Users\Admin\AppData\Local\Temp\apm579.tmp

Filesize
146KB

MD5
3d4839228c7ee77e28832879eeb17340

SHA1
ebe4a6388c8c6831837e232b48b8f4266b7f711e

SHA256
5d6ff8a11cda6d5b1e6d8a5562594379a082cee18f402a8a0a26b8cabe428954

SHA512
f3c534524eaa4b51ee44a6c1d05a142c0d10d9c1c48db79b60903dd948d5712b367479b82cd85fa8ee094dcd2569c0fd85a36c10c97deab59e49e1f1f4da6c56

Download Submit
memory/2332-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2332-5-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/2332-7-0x0000000010000000-0x000000001007E000-memory.dmp

Filesize
504KB

Download
memory/2332-6-0x0000000000400000-0x00000000005B0000-memory.dmp

Filesize
1.7MB

Download
memory/2332-10-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download