10e9e77c9c6e1f03d6b99c3f8fbf7c303b38bcbe0135190235c9d21bc447389d

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 00:04

Target

3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe
Size

48KB
MD5

3b7be46d9681ae663cdabfbff906fbb0
SHA1

58cf633e65183f6e10c6e7a64b7da2b4e68afe14
SHA256

10e9e77c9c6e1f03d6b99c3f8fbf7c303b38bcbe0135190235c9d21bc447389d
SHA512

c2222e2b2761a00c0feb96d1bc253925f1bbee7cc92decdccf67715510c819e0c22409c69b4cef8f73fe9287e8f64f1d5ac27747ccdf3595b08596485fac5f3b
SSDEEP

1536:ZBCrmih8u2+3ATdPHCjpkvxtbf8QE9gGUm:ZgiihtfQOL7xZ

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4904	razacer.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4724-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/files/0x00070000000232a4-4.dat	upx
behavioral2/memory/4724-6-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4904-8-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4904	4724	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	81
PID 4724 wrote to memory of 4904	4724	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	81
PID 4724 wrote to memory of 4904	4724	3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b7be46d9681ae663cdabfbff906fbb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\razacer.exe
  C:\Users\Admin\AppData\Local\Temp\razacer.exe
  2⤵
  - Executes dropped EXE
  PID:4904

C:\Users\Admin\AppData\Local\Temp\razacer.exe

Filesize
48KB

MD5
ea160b2bf2b020bfcdf1c46422e0f787

SHA1
09d43d784bf5e54b6e3303f680f52d77a3ba6ab9

SHA256
178e720fbee615c7338abb8bae2ad92bd893c95eb68675622efaecdd20ec1125

SHA512
2b51968613d177f00c914887a6c7e5a89a9f1ea91c65f5d9d41f80d413796c736167fa06ff3c07a25ed08bed7a8920cd49c9715d7ffd3072dc0f95c37ee40400

Download Submit
memory/4724-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4724-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4724-3-0x0000000000402000-0x0000000000404000-memory.dmp

Filesize
8KB

Download
memory/4904-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download