10e9e77c9c6e1f03d6b99c3f8fbf7c303b38bcbe0135190235c9d21bc447389d

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 00:04

Target

3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe
Size

48KB
MD5

3b7be46d9681ae663cdabfbff906fbb0
SHA1

58cf633e65183f6e10c6e7a64b7da2b4e68afe14
SHA256

10e9e77c9c6e1f03d6b99c3f8fbf7c303b38bcbe0135190235c9d21bc447389d
SHA512

c2222e2b2761a00c0feb96d1bc253925f1bbee7cc92decdccf67715510c819e0c22409c69b4cef8f73fe9287e8f64f1d5ac27747ccdf3595b08596485fac5f3b
SSDEEP

1536:ZBCrmih8u2+3ATdPHCjpkvxtbf8QE9gGUm:ZgiihtfQOL7xZ

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1656	razacer.exe

Loads dropped DLL 1 IoCs

pid	Process
2360	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2360-6-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x000c00000001342e-2.dat	upx
behavioral1/memory/1656-8-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1656-11-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1656	2360	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 1656	2360	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 1656	2360	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 1656	2360	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\razacer.exe
  C:\Users\Admin\AppData\Local\Temp\razacer.exe
  2⤵
  - Executes dropped EXE
  PID:1656

\Users\Admin\AppData\Local\Temp\razacer.exe

Filesize
48KB

MD5
ea160b2bf2b020bfcdf1c46422e0f787

SHA1
09d43d784bf5e54b6e3303f680f52d77a3ba6ab9

SHA256
178e720fbee615c7338abb8bae2ad92bd893c95eb68675622efaecdd20ec1125

SHA512
2b51968613d177f00c914887a6c7e5a89a9f1ea91c65f5d9d41f80d413796c736167fa06ff3c07a25ed08bed7a8920cd49c9715d7ffd3072dc0f95c37ee40400

Download Submit
memory/1656-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1656-10-0x0000000000402000-0x0000000000404000-memory.dmp

Filesize
8KB

Download
memory/1656-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2360-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2360-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download