35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:33

Target

35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
Size

9.5MB
MD5

1e5083bc517655e282c903503e399100
SHA1

7b5d0ae0069725ec200828f8c44a6580180a4b7f
SHA256

35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09
SHA512

973ad5d74d6d77f69bb20189abf30283b53a42cf38b891defdfb34717b9ecca1c2239385e07458449f79507e17599ce670095910fe4b9db5b2231feead79d39b
SSDEEP

196608:lPWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWr:lq

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

svrwsc.exe

pid process

2068 svrwsc.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/2432-0-0x0000000000400000-0x000000000042A000-memory.dmp upx
C:\Windows\SysWOW64\svrwsc.exe upx
Drops file in System32 directory 2 IoCs

Processes:

35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exesvrwsc.exe

description ioc process

File created C:\Windows\SysWOW64\svrwsc.exe 35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe

pid	process
2068	svrwsc.exe

resource	yara_rule
behavioral1/memory/2432-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
C:\Windows\SysWOW64\svrwsc.exe	upx

description	ioc	process
File created	C:\Windows\SysWOW64\svrwsc.exe	35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

C:\Users\Admin\AppData\Local\Temp\35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:2432

C:\Windows\SysWOW64\svrwsc.exe
Filesize
9.8MB

MD5
c28fdb709073ae30d43ca3ccf852db0a

SHA1
7119ded4656a2d052f019ce1ed95a765e4eff5e2

SHA256
379bd7da9c45e56b97ed98ef160c49f2870076615b15d4b39cf9c2bd5368f2e3

SHA512
8048a880dd7e4cecaadeff4fcd6af25763dcc6f2a0972408f2da6051973730849c847879a319aa3a9bd71377daf6bf6ee2ae9d55225a4f2015fd335137325441

Download Submit
memory/2068-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2432-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2432-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2432-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download