c3545f70340952cc05f0b72fd35ead34fbb1debb6ca30289ebd94e4c4972dc4e

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 08:28

Target

2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe
Size

73KB
MD5

2afa383ba2f55beebe3ee0025c06d220
SHA1

05aa5538afc635fa7ded3628640a7ae08dc44dda
SHA256

c3545f70340952cc05f0b72fd35ead34fbb1debb6ca30289ebd94e4c4972dc4e
SHA512

9b984a2a272028b724119d431bccf4e6007a43bbe0b8cd0d6b62696e3332f0a2d9078cbd3d45ee43c30de9d4c2485a70d51ca1e45d487066e3ebfac00e34463e
SSDEEP

768:lhB5prqhHGaAbkOoT6JUU3FIFYrG5RUyGeQUzpPlpHwrxag7jpiTTGE6vxa2Dl:/dwHGK2UU3FIFYCnJZlpHwlag7CThqd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2376	cadvahin.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2376	1688	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	28
PID 1688 wrote to memory of 2376	1688	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	28
PID 1688 wrote to memory of 2376	1688	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	28
PID 1688 wrote to memory of 2376	1688	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  2⤵
  - Executes dropped EXE
  PID:2376

\Users\Admin\AppData\Local\Temp\cadvahin.exe

Filesize
73KB

MD5
7e6190170916ffee0b6f39fa7fcd8aab

SHA1
5e0c138eae186ae9c733a79641403d93965af564

SHA256
45d1e2a0ec0b48e64141ed97763bda84b5278176f9b0fc01fac85aa0b0e310c7

SHA512
0502ee673f90a000767a625cb24933f9cb58c0fd49d2c70a5f4cd489668ff0d608210743cb4642cc28335725f4b46211e0dd0c3787ca03f54755fa05a6f48411

Download Submit
memory/1688-1-0x00000000004D1000-0x00000000004D4000-memory.dmp

Filesize
12KB

Download
memory/2376-6-0x00000000008B1000-0x00000000008B4000-memory.dmp

Filesize
12KB

Download