a09d9b9cd61d203f5b6283781180c030fe453deb482860e8188603fe36d15223

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:34

Target

7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe
Size

381KB
MD5

7fa854cea9e5d21e2d8bbb3a492395d0
SHA1

2b23b63746320fdab5739a75b9e4370ea925d2e9
SHA256

a09d9b9cd61d203f5b6283781180c030fe453deb482860e8188603fe36d15223
SHA512

d9b110b09dd0b772c98cfe355efcb91734e0945f3b472c7b95b46c6346f7c5442978362363a47f8adec4ab45066b7317d80e8a6b23b51983805c785e98f7f4e2
SSDEEP

3072:QtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwvwKbk0i0kfS:wuj8NDF3OR9/Qe2HdJfwKbk0i0B

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1048	LiveMessageCenter.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	casino_extensions.exe
1048	LiveMessageCenter.exe

Loads dropped DLL 4 IoCs

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1048	LiveMessageCenter.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2320	7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1196	2320	7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 1196	2320	7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 1196	2320	7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 1196	2320	7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe	28
PID 1196 wrote to memory of 2852	1196	casino_extensions.exe	29
PID 1196 wrote to memory of 2852	1196	casino_extensions.exe	29
PID 1196 wrote to memory of 2852	1196	casino_extensions.exe	29
PID 1196 wrote to memory of 2852	1196	casino_extensions.exe	29
PID 2852 wrote to memory of 1404	2852	casino_extensions.exe	30
PID 2852 wrote to memory of 1404	2852	casino_extensions.exe	30
PID 2852 wrote to memory of 1404	2852	casino_extensions.exe	30
PID 2852 wrote to memory of 1404	2852	casino_extensions.exe	30
PID 1404 wrote to memory of 1048	1404	casino_extensions.exe	31
PID 1404 wrote to memory of 1048	1404	casino_extensions.exe	31
PID 1404 wrote to memory of 1048	1404	casino_extensions.exe	31
PID 1404 wrote to memory of 1048	1404	casino_extensions.exe	31

\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
395KB

MD5
7aee9dd0dab85168f4f390d04bf26923

SHA1
6174b830aabbe3b54f8b4fa4aea002ebc95a0a6d

SHA256
d503965ba6e1a616eb2398db96190071cfd71b5f7b39eed7327858736af49542

SHA512
c126e7881b10e41cad8fcc24f9ea0111833f33a6d8a0268a5b9a8b876005f862454a49e19dc7c4c51c3dc347d733472b5565ad4b28e994bdcaf313d1afeac616

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
392KB

MD5
64b7c2a685ed89bafcb35abd32dc6ef1

SHA1
266cdc32d9c857cae5ce09a7f015224fe5191289

SHA256
5f53be590195952f9a8375c8c5c06f46e9bf1e5584fe3f5d0daa741f930d7a0d

SHA512
419f36521774da1ffa4ba35e9c0777a85e652b55ea56c2e47edc43a02d6edd3bfd81d738dd313573b28a50f49ce840ef2d9fe5dcabe4c61d353cf434d23adb00

Download Submit
memory/2320-20-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download