c3baffd5d825ffff2c6c98fd85e46bc47008a77a14b90cdf6903d801beaed080

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 15:01

Target

6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe
Size

51KB
MD5

6a20d052725ed73d1c15779cadea75c0
SHA1

d49eb7a941070ee6ae05e5586cc9895d5fab05c5
SHA256

c3baffd5d825ffff2c6c98fd85e46bc47008a77a14b90cdf6903d801beaed080
SHA512

d6a6f0d30dc5bca75b996d5996a08e1d7edd1b3201721e425c151c372fe455aea6da8d61164e046b707614540f33f8504189bb6ba32aa7f12ed47abf3a123c7d
SSDEEP

768:0M7kP0swFY6cPf/t+Vin9rOHialu0+qiWiSM81rVZVUCkzWdt8JE:0M4P0soYB/Iwn96H/unXjErZjdt8JE

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2328	ofylywo.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2328	1476	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	81
PID 1476 wrote to memory of 2328	1476	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	81
PID 1476 wrote to memory of 2328	1476	6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a20d052725ed73d1c15779cadea75c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:2328

C:\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
51KB

MD5
aaeaee30bf00f0c544bab7db8b884838

SHA1
4a039e23484547921569ebd02967dd8e95004245

SHA256
ec605b3ea1810728a86bfd9984fef9ac3eea21c7aad9caec1647a85907429107

SHA512
7e21ebf611773bbb01552556007a2d7e34d7dbfeddc849b80f8a3512aa9daddd65442761d3811dbb4114cb79755febca9d4747d29ac446cd18f3a394c59030fb

Download Submit
memory/1476-0-0x0000000000AE0000-0x0000000000AE2000-memory.dmp

Filesize
8KB

Download
memory/1476-3-0x0000000000FD1000-0x0000000000FD3000-memory.dmp

Filesize
8KB

Download
memory/2328-6-0x0000000001320000-0x0000000001322000-memory.dmp

Filesize
8KB

Download
memory/2328-7-0x0000000000561000-0x0000000000563000-memory.dmp

Filesize
8KB

Download