35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09

Analysis

max time kernel
53s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:33

Target

35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
Size

9.5MB
MD5

1e5083bc517655e282c903503e399100
SHA1

7b5d0ae0069725ec200828f8c44a6580180a4b7f
SHA256

35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09
SHA512

973ad5d74d6d77f69bb20189abf30283b53a42cf38b891defdfb34717b9ecca1c2239385e07458449f79507e17599ce670095910fe4b9db5b2231feead79d39b
SSDEEP

196608:lPWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWr:lq

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

svrwsc.exe

pid process

3744 svrwsc.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Windows\SysWOW64\svrwsc.exe upx
behavioral2/memory/3744-5-0x0000000000400000-0x000000000042A000-memory.dmp upx
Drops file in System32 directory 2 IoCs

Processes:

35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exesvrwsc.exe

description ioc process

File created C:\Windows\SysWOW64\svrwsc.exe 35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe

pid	process
3744	svrwsc.exe

resource	yara_rule
C:\Windows\SysWOW64\svrwsc.exe	upx
behavioral2/memory/3744-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx

description	ioc	process
File created	C:\Windows\SysWOW64\svrwsc.exe	35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

C:\Users\Admin\AppData\Local\Temp\35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35a1dbc59370f12595f1666f7a54a5e6ef892a1f0f33220943bb211e835f0f09_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:3280

C:\Windows\SysWOW64\svrwsc.exe
Filesize
9.8MB

MD5
15a5b54cc5d98e4acba053b661962ff8

SHA1
b71d4c2d0779cea14e671771a4553d923602aaa5

SHA256
7499b9997bc29cf8ccbfc38387e645c158b39a21c948245f3a029b50608a0be1

SHA512
914d05a10729ef36a7e6ac44678505a8e110a6ce7ebb758d43c377cb110193cedb0da51cd1a9d834c1933d22523c5b1c7f3720ab63655d528c09fa18151532dd

Download Submit
memory/3280-2-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download
memory/3280-1-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3744-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3744-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download