metasploit | 0dd651329cc9263c403946d91032a721c038880a69f8be28c0b9d04fa35c6ad3

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 23:38

Target

0dd651329cc9263c403946d91032a721c038880a69f8be28c0b9d04fa35c6ad3_NeikiAnalytics.exe
Size

47KB
MD5

88874eb54afceda1290756fa126206c0
SHA1

e84f4a3faa1bf00386b043fe6c0f925e3727ac04
SHA256

0dd651329cc9263c403946d91032a721c038880a69f8be28c0b9d04fa35c6ad3
SHA512

a7689a0cd12bd8eec42d5dc4b3bf73dad1c516eb70b687bda5b5efaff43b1b1a580a31da3a45b6d67eb1d3958f569849e677190823b25828769f02237d457d45
SSDEEP

768:IX69Czwlc8oBmPpRk9BzdMPY2mKukoeW8cw8RluvNz3oY7ZQ4R7ssXq3:IKEnMPPkTa6KuneWTu1zB7ZQUACq3

Score

10^/10

Family

metasploit

Version

encoder/shikata_ga_nai

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/3000-0-0x0000000000400000-0x0000000000419000-memory.dmp upx
behavioral1/memory/3000-2-0x0000000000400000-0x0000000000419000-memory.dmp upx

resource	yara_rule
behavioral1/memory/3000-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/3000-2-0x0000000000400000-0x0000000000419000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\0dd651329cc9263c403946d91032a721c038880a69f8be28c0b9d04fa35c6ad3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0dd651329cc9263c403946d91032a721c038880a69f8be28c0b9d04fa35c6ad3_NeikiAnalytics.exe"
1⤵
PID:3000

memory/3000-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3000-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3000-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download