91923805dc817c65f79b1041ed3f3ec674bc6ec084621e521baea8868749cb51

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 11:37

Target

8c9de6d509797fb7ee0d586969db6270_NEIKI.exe
Size

60KB
MD5

8c9de6d509797fb7ee0d586969db6270
SHA1

bb86c5c02d0139ae93ec6e4c0c8e16a15aae188e
SHA256

91923805dc817c65f79b1041ed3f3ec674bc6ec084621e521baea8868749cb51
SHA512

57625f6d9bf7ddbf015a8001da89e0b5cfceb548a46841523a5e650953bbacf7bdd097db6b64d676f693a4ac9d8b674a5275a50324208a02c08044d86038196f
SSDEEP

768:ahZyc5B97Dpnb6vfNtSTucPGFTxRijy6A6cb5D7dXWj2deFPyp+d+R9Zx:ahZJF7NYtSTuuQTzijy6Ne5D7hqjFyh

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
944	rianesad.exe

Loads dropped DLL 1 IoCs

pid	Process
2956	8c9de6d509797fb7ee0d586969db6270_NEIKI.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 944	2956	8c9de6d509797fb7ee0d586969db6270_NEIKI.exe	28
PID 2956 wrote to memory of 944	2956	8c9de6d509797fb7ee0d586969db6270_NEIKI.exe	28
PID 2956 wrote to memory of 944	2956	8c9de6d509797fb7ee0d586969db6270_NEIKI.exe	28
PID 2956 wrote to memory of 944	2956	8c9de6d509797fb7ee0d586969db6270_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\8c9de6d509797fb7ee0d586969db6270_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\8c9de6d509797fb7ee0d586969db6270_NEIKI.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\rianesad.exe
  C:\Users\Admin\AppData\Local\Temp\rianesad.exe
  2⤵
  - Executes dropped EXE
  PID:944

C:\Users\Admin\AppData\Local\Temp\rianesad.exe

Filesize
60KB

MD5
816105cda6e5304bab458903e8322e56

SHA1
3d349c7042b70f288870b8d6a50c62eff2642559

SHA256
3e3d004504c4972610fddf7b734d9978d186251138678e423a3d4a358b78aaa6

SHA512
56eae545b630547b1b9dcd25acec0f6b0db7f5d7ea5f424132fa90cb83e12462f0e7fffd32358e7b66170c6c312163333c849990b0b68ab92d77936a90f244b9

Download Submit
memory/944-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2956-1-0x0000000000403000-0x0000000000405000-memory.dmp

Filesize
8KB

Download