030c517fee13f5bdb7c99c4e5ea6f209e715835d198c2928f0a5c16755aac6e7

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 07:25

Target

a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe
Size

96KB
MD5

a06dc5755360e9e29abaeddc103005a0
SHA1

ea43f66cfd5b1cc67fb103f1bc6618026a4fa32c
SHA256

030c517fee13f5bdb7c99c4e5ea6f209e715835d198c2928f0a5c16755aac6e7
SHA512

33b35b67202ac5ac2ed22f0c44232f5f31d3a4471a4cdab0b58fb50cc6fc782a646cf951d64121ed716b49800a580e4988fa7232a2f153db6f7115ac3378ffe2
SSDEEP

1536:TalEkKgJOyjc4oqULVJBoLmcYXV/O16nvaHWpeQrZYTjipvF2uN1PomZ:vbOHw5qLmcYXVlnvk8YvQd22T

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2524	antifahib.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2524	1464	a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe	82
PID 1464 wrote to memory of 2524	1464	a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe	82
PID 1464 wrote to memory of 2524	1464	a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a06dc5755360e9e29abaeddc103005a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\antifahib.exe
  C:\Users\Admin\AppData\Local\Temp\antifahib.exe
  2⤵
  - Executes dropped EXE
  PID:2524

C:\Users\Admin\AppData\Local\Temp\antifahib.exe

Filesize
96KB

MD5
4f23e0c0c2cab633cf1e87d83ebaa8a0

SHA1
1bcb60b86b1394eea2febda097fdf842fc87d79f

SHA256
79fd9aa6fa1805e5d1152a66a29fbcec7d13f3a7ae882745db20ec49f86667b6

SHA512
f2e2936e33b3823af3a81815e3184b427a3daddc0b809b622b0aacf0545bc0623a087df362575f686c05c80a9a4174e62c5a336e93bf8920e4c48d76c66462ce

Download Submit
memory/1464-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1464-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2524-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2524-8-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2524-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download