2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:40

Target

2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe
Size

2.7MB
MD5

f73c159c4c546ee897378c3049cb0dd0
SHA1

09756402ff34ab2486d9c4a344dce2ebf3904042
SHA256

2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf
SHA512

70e43ddc54038deb4dfd607de8aa425e2ec6b9c5a0a7de61144fc985bc3344bb598a9acf067a904d8391e6ab9052d343dbbc60b7b157de958de630099392e8e8
SSDEEP

49152:NkQTA7kjdVPFc8w4FXE/D98Ezxq/JFIxK5VjLgmRUxUnZ0LtyfvPB5QPzuZtNp:Na7MbPFcz4EurJFIUzRQw0JyfvyotX

Score

7^/10

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral1/memory/2880-16-0x0000000000400000-0x00000000006B9000-memory.dmp vmprotect
behavioral1/memory/2880-26-0x0000000000400000-0x00000000006B9000-memory.dmp vmprotect
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe

pid process

2880 2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe
2880 2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe

resource	yara_rule
behavioral1/memory/2880-16-0x0000000000400000-0x00000000006B9000-memory.dmp	vmprotect
behavioral1/memory/2880-26-0x0000000000400000-0x00000000006B9000-memory.dmp	vmprotect

pid	process
2880	2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe
2880	2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2bd45830fa27fb5e1249baeb81ae2ed39977c2be43e97e662c833d47d054f7bf_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2880

memory/2880-0-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-23-0x0000000077470000-0x0000000077471000-memory.dmp

Filesize
4KB

Download
memory/2880-2-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-14-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-24-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-17-0x00000000002C0000-0x00000000002FF000-memory.dmp

Filesize
252KB

Download
memory/2880-16-0x0000000000400000-0x00000000006B9000-memory.dmp

Filesize
2.7MB

Download
memory/2880-12-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-10-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-8-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-6-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-4-0x00000000775E0000-0x00000000775E1000-memory.dmp

Filesize
4KB

Download
memory/2880-22-0x000000007746F000-0x0000000077470000-memory.dmp

Filesize
4KB

Download
memory/2880-25-0x00000000002C0000-0x00000000002FF000-memory.dmp

Filesize
252KB

Download
memory/2880-26-0x0000000000400000-0x00000000006B9000-memory.dmp

Filesize
2.7MB

Download