1db9029a165f892c09509152c125a03a627b0079dd366c0a00726aa2d6833d6c

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:46

Target

0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe
Size

77KB
MD5

0f664b0cc1cd9715add46b062d4e77b0
SHA1

325e6d2b0c92552964b7734fce03969e2bd514a5
SHA256

1db9029a165f892c09509152c125a03a627b0079dd366c0a00726aa2d6833d6c
SHA512

81a8cbe39fc7fc2fdbf27dc151c253a871db2b3358f6f32a5c568703ce8ca5bea71f988a1479715e72e72ed5431206aed4cbc1b6d9e704bbcf1d24020bd1145c
SSDEEP

768:UbNjs/1T6PPqi7DSlhVtQZsQ/TTiZT3i50A:iNjs/ZlhVtWsQ/T2Z40A

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3068	famudit.exe

Loads dropped DLL 1 IoCs

pid	Process
2548	0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3068	2548	0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe	28
PID 2548 wrote to memory of 3068	2548	0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe	28
PID 2548 wrote to memory of 3068	2548	0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe	28
PID 2548 wrote to memory of 3068	2548	0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f664b0cc1cd9715add46b062d4e77b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\famudit.exe
  C:\Users\Admin\AppData\Local\Temp\famudit.exe
  2⤵
  - Executes dropped EXE
  PID:3068

C:\Users\Admin\AppData\Local\Temp\famudit.exe

Filesize
77KB

MD5
6bb351d6a015a3a45cc425a71661b3e6

SHA1
c83c68d5b1acef042f3bd50d5b8e3a59f8596459

SHA256
fbb28881866ed2719a5575ec827556b6124705ac012d7cad9f5246df2ad3029e

SHA512
9aa344d47a350b6da8915a7c4ab1ea23f0ca148fbdc659b0c5f70d448d484bc07fa923961159e38b2fcd27453949b4c386f1c841bea8e1b2c63c910f838e0adc

Download Submit
memory/2548-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2548-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2548-5-0x0000000000402000-0x0000000000404000-memory.dmp

Filesize
8KB

Download
memory/3068-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download