c0267ba1b6110fa8326d17dbf8bffe5c654e03cd7aecb52d36e3edf243d874c0

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 01:11

Target

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Size

80KB
MD5

2b83a09e84544150bb676294d73985f0
SHA1

2448a9673b914e75191a2d5048ca30ea5ca4f1dc
SHA256

c0267ba1b6110fa8326d17dbf8bffe5c654e03cd7aecb52d36e3edf243d874c0
SHA512

0c7dcc1253731696552c4601affc69012055694c006f8fe0581c4da07487892976d92ff1a23f03ba78db9c5db0338703d338422553e7979086fa987c6c96b323
SSDEEP

1536:/hdt9uI7Y3Zd9AfGzGkZVshBSez3McAbEUdEle3hDrFxlhRXT0CmuJd4BXL:/HuI7cef6G5ueLMccEizjXhhTBbd45

Score

7^/10

Deletes itself 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

1188 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

1188 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Loads dropped DLL 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

2952 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
1188	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
1188	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2952-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/1188-17-0x0000000000400000-0x000000000043A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

2952 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

2952 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
1188 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
1188	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

description	pid	process	target process
PID 2952 wrote to memory of 1188	2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
PID 2952 wrote to memory of 1188	2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
PID 2952 wrote to memory of 1188	2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
PID 2952 wrote to memory of 1188	2952	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Filesize
80KB

MD5
bed21e18a66705d6c7d0fc58d556e8bb

SHA1
e5ba22396061cd89249ce08db2e7981a5b87059b

SHA256
d41c8642a20049b3ec793cb0b197eef7ba03c3499b88bd6d27c2666dd41258b0

SHA512
cd09ff9881ecc3281dc3bcd1c38ef96d3264dca65a4eedd9d10a57fce5319b5b235d48ae1d01db84cb4afa1b9445722a6d5c3cc0d06713f00a6755f790fed78e

Download Submit
memory/1188-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1188-29-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/1188-28-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/1188-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1188-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1188-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2952-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2952-9-0x0000000000030000-0x000000000003E000-memory.dmp

Filesize
56KB

Download
memory/2952-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2952-15-0x0000000000160000-0x000000000019A000-memory.dmp

Filesize
232KB

Download
memory/2952-14-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download