5f068e11710d6b6c7dbdc910796a70a71b2ca40789e96e550c8e3d29b6b884ef

General

Target

2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe
Size

713KB
MD5

2c30cce23d84af662846c14ed0a2bbd0
SHA1

124f90b18128c595b3034a2aa5c88d2301bb0e6c
SHA256

5f068e11710d6b6c7dbdc910796a70a71b2ca40789e96e550c8e3d29b6b884ef
SHA512

0033b25d8851af1e290f52fe68b43deb1c69a76be1bcc1a2c80e19574fff15688d36478d3986c0e0c62d704d94d16c59e99346ad55612fda5192c942b65f0f4f
SSDEEP

6144:Buj8NDF3OR9/Qe2HdklrSqjzQtJnjqno2k29r:wOF3ORK3d9QzQtJnjqno2k29r

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	Casino_ext.exe

Executes dropped EXE 4 IoCs

pid	Process
464	casino_extensions.exe
2672	Casino_ext.exe
2932	casino_extensions.exe
2716	Casino_ext.exe

Loads dropped DLL 4 IoCs

pid	Process
316	casino_extensions.exe
316	casino_extensions.exe
2584	casino_extensions.exe
2584	casino_extensions.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2672	Casino_ext.exe
2716	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2068	2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 316	2068	2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe	28
PID 2068 wrote to memory of 316	2068	2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe	28
PID 2068 wrote to memory of 316	2068	2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe	28
PID 2068 wrote to memory of 316	2068	2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe	28
PID 316 wrote to memory of 464	316	casino_extensions.exe	29
PID 316 wrote to memory of 464	316	casino_extensions.exe	29
PID 316 wrote to memory of 464	316	casino_extensions.exe	29
PID 316 wrote to memory of 464	316	casino_extensions.exe	29
PID 464 wrote to memory of 2672	464	casino_extensions.exe	30
PID 464 wrote to memory of 2672	464	casino_extensions.exe	30
PID 464 wrote to memory of 2672	464	casino_extensions.exe	30
PID 464 wrote to memory of 2672	464	casino_extensions.exe	30
PID 2672 wrote to memory of 2584	2672	Casino_ext.exe	31
PID 2672 wrote to memory of 2584	2672	Casino_ext.exe	31
PID 2672 wrote to memory of 2584	2672	Casino_ext.exe	31
PID 2672 wrote to memory of 2584	2672	Casino_ext.exe	31
PID 2584 wrote to memory of 2932	2584	casino_extensions.exe	32
PID 2584 wrote to memory of 2932	2584	casino_extensions.exe	32
PID 2584 wrote to memory of 2932	2584	casino_extensions.exe	32
PID 2584 wrote to memory of 2932	2584	casino_extensions.exe	32
PID 2932 wrote to memory of 2716	2932	casino_extensions.exe	33
PID 2932 wrote to memory of 2716	2932	casino_extensions.exe	33
PID 2932 wrote to memory of 2716	2932	casino_extensions.exe	33
PID 2932 wrote to memory of 2716	2932	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\2c30cce23d84af662846c14ed0a2bbd0_NEIKI.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Deletes itself
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\casino_extensions.exe

Filesize
721KB

MD5
edaa20049b99721a65e9fc4abed94815

SHA1
49b3830f48b551b3f4857ddfd4f909aabb89fd81

SHA256
5ab063a53d2c4a6f664791b0d78cba98fc58e6933c2eda12b4b6b7348b4b504d

SHA512
15920dfaf599c9340c66894553b89b84c472653b335d464197b6809c2a433bffacaa10c64c85d78f33d15d8e8e731eed0238a345f36ab09a4611fb6f68ebc3bc

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
727KB

MD5
f58363ad47b07c9f9db024a8d77033b5

SHA1
eab6b555592367ddf94fd16de6e4835df01f8049

SHA256
1ef7d2b25e26a7cf42c182bb87a444bf03d79eaec3baf8adc6886c21689c583a

SHA512
534e2452b1f53f3fef8ec0442167ed7b41c0eb5ea33237a91e83dcff3743b8a91f1e12b324f778c87cc61d4c60d8fd7a0aca3ff98fa3f595ac9fa9d1fb16afc5

Download Submit
memory/464-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2068-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2584-26-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing