c3baffd5d825ffff2c6c98fd85e46bc47008a77a14b90cdf6903d801beaed080

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 15:01

Target

6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe
Size

51KB
MD5

6a20d052725ed73d1c15779cadea75c0
SHA1

d49eb7a941070ee6ae05e5586cc9895d5fab05c5
SHA256

c3baffd5d825ffff2c6c98fd85e46bc47008a77a14b90cdf6903d801beaed080
SHA512

d6a6f0d30dc5bca75b996d5996a08e1d7edd1b3201721e425c151c372fe455aea6da8d61164e046b707614540f33f8504189bb6ba32aa7f12ed47abf3a123c7d
SSDEEP

768:0M7kP0swFY6cPf/t+Vin9rOHialu0+qiWiSM81rVZVUCkzWdt8JE:0M4P0soYB/Iwn96H/unXjErZjdt8JE

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1280	ofylywo.exe

Loads dropped DLL 1 IoCs

pid	Process
2972	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1280	2972	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	28
PID 2972 wrote to memory of 1280	2972	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	28
PID 2972 wrote to memory of 1280	2972	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	28
PID 2972 wrote to memory of 1280	2972	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:1280

C:\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
51KB

MD5
aaeaee30bf00f0c544bab7db8b884838

SHA1
4a039e23484547921569ebd02967dd8e95004245

SHA256
ec605b3ea1810728a86bfd9984fef9ac3eea21c7aad9caec1647a85907429107

SHA512
7e21ebf611773bbb01552556007a2d7e34d7dbfeddc849b80f8a3512aa9daddd65442761d3811dbb4114cb79755febca9d4747d29ac446cd18f3a394c59030fb

Download Submit
memory/1280-7-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1280-8-0x0000000000FA1000-0x0000000000FA3000-memory.dmp

Filesize
8KB

Download
memory/2972-0-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2972-5-0x0000000000D71000-0x0000000000D73000-memory.dmp

Filesize
8KB

Download