c3545f70340952cc05f0b72fd35ead34fbb1debb6ca30289ebd94e4c4972dc4e

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 08:28

Target

2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe
Size

73KB
MD5

2afa383ba2f55beebe3ee0025c06d220
SHA1

05aa5538afc635fa7ded3628640a7ae08dc44dda
SHA256

c3545f70340952cc05f0b72fd35ead34fbb1debb6ca30289ebd94e4c4972dc4e
SHA512

9b984a2a272028b724119d431bccf4e6007a43bbe0b8cd0d6b62696e3332f0a2d9078cbd3d45ee43c30de9d4c2485a70d51ca1e45d487066e3ebfac00e34463e
SSDEEP

768:lhB5prqhHGaAbkOoT6JUU3FIFYrG5RUyGeQUzpPlpHwrxag7jpiTTGE6vxa2Dl:/dwHGK2UU3FIFYCnJZlpHwlag7CThqd

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
848	cadvahin.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 848	4940	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	84
PID 4940 wrote to memory of 848	4940	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	84
PID 4940 wrote to memory of 848	4940	2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe	84

C:\Users\Admin\AppData\Local\Temp\2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\2afa383ba2f55beebe3ee0025c06d220_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  C:\Users\Admin\AppData\Local\Temp\cadvahin.exe
  2⤵
  - Executes dropped EXE
  PID:848

C:\Users\Admin\AppData\Local\Temp\cadvahin.exe

Filesize
73KB

MD5
7e6190170916ffee0b6f39fa7fcd8aab

SHA1
5e0c138eae186ae9c733a79641403d93965af564

SHA256
45d1e2a0ec0b48e64141ed97763bda84b5278176f9b0fc01fac85aa0b0e310c7

SHA512
0502ee673f90a000767a625cb24933f9cb58c0fd49d2c70a5f4cd489668ff0d608210743cb4642cc28335725f4b46211e0dd0c3787ca03f54755fa05a6f48411

Download Submit
memory/848-5-0x0000000000EF1000-0x0000000000EF4000-memory.dmp

Filesize
12KB

Download
memory/4940-0-0x0000000000ED1000-0x0000000000ED4000-memory.dmp

Filesize
12KB

Download