c0267ba1b6110fa8326d17dbf8bffe5c654e03cd7aecb52d36e3edf243d874c0

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 01:11

Target

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Size

80KB
MD5

2b83a09e84544150bb676294d73985f0
SHA1

2448a9673b914e75191a2d5048ca30ea5ca4f1dc
SHA256

c0267ba1b6110fa8326d17dbf8bffe5c654e03cd7aecb52d36e3edf243d874c0
SHA512

0c7dcc1253731696552c4601affc69012055694c006f8fe0581c4da07487892976d92ff1a23f03ba78db9c5db0338703d338422553e7979086fa987c6c96b323
SSDEEP

1536:/hdt9uI7Y3Zd9AfGzGkZVshBSez3McAbEUdEle3hDrFxlhRXT0CmuJd4BXL:/HuI7cef6G5ueLMccEizjXhhTBbd45

Score

7^/10

Deletes itself 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

1236 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

1236 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
1236	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
1236	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1428-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	upx
behavioral2/memory/1236-13-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

1428 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid process

1428 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
1236 2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
1428	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

pid	process
1428	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
1236	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

description	pid	process	target process
PID 1428 wrote to memory of 1236	1428	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
PID 1428 wrote to memory of 1236	1428	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
PID 1428 wrote to memory of 1236	1428	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe	2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2b83a09e84544150bb676294d73985f0_NeikiAnalytics.exe
Filesize
80KB

MD5
2d9d29f2c9ad074c6a2301b2923ac0ee

SHA1
683d1b3bdcec8abc3e44b6d78400de4db9cdc16a

SHA256
46b89178f24eff29a4c4b23bd2ed846259664799180b1fe51cfc44d0a4d0d224

SHA512
8f7bc4b8c702aac1576f3867e599cc2ff9c880c9988ebc6a5c925487bbaea96443fa83cd74d34d2b62c4afa34e3ce58fb62c9aa589b7277c175be52774beaed8

Download Submit
memory/1236-13-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1236-14-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1236-19-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download
memory/1236-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1236-25-0x0000000004D60000-0x0000000004D7B000-memory.dmp

Filesize
108KB

Download
memory/1236-26-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1428-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1428-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/1428-3-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1428-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download