271a69ceed684d91bc283a4b0cabd48f5d566e2059187fecd958007ee75459cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 21:35

Target
3b8595689004aba158be1d842deb7c50_NeikiAnalytics.exe
Size 56KB
Sample240515-1fp6ssde23
SHA256 271a69ceed684d91bc283a4b0cabd48f5d566e2059187fecd958007ee75459cd
MD5 3b8595689004aba158be1d842deb7c50
SHA1 bd568fa7027479d1b8f207c7d4a453cf19d86c30
SHA512 86411481b3b29ffb56d22f42b60a411491130e84a16f4df7e2aea440e55163ce0e721f9fe72d785868a792c76e18ad55b6ea7302b0741633168528c0fde21157
SSDEEP 1536:QikeKhs7PNZvInX0Wbh8UH9SZ47Qn/ujOFAG5P5:sxhyfAvH9SZ4uuj4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2192	olacweegim.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	checkip.dyndns.org

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2192	3616	3b8595689004aba158be1d842deb7c50_NeikiAnalytics.exe	82
PID 3616 wrote to memory of 2192	3616	3b8595689004aba158be1d842deb7c50_NeikiAnalytics.exe	82
PID 3616 wrote to memory of 2192	3616	3b8595689004aba158be1d842deb7c50_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\3b8595689004aba158be1d842deb7c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b8595689004aba158be1d842deb7c50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:2192

olacweegim.exe

Path C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
Size 56KB
SHA256 5f421a43c8ddf6c3b41172c040a29a9853bd1fc6e99064745cea0922b0e3898b
MD5 7f22e140b2a4e43c5306e17a00061a85
SHA1 2098815a5ed23238d2e07d89402ff4fd05c60fdd
SHA512 9fec2e305449558c2cb688e72eca5c13cbbf8fe6be045f916ef51e1a26c925179f76695f70e8cd13418b9272fb36b4272c8ce57a6d0ee6552c499798f4afd643
SSDEEP 1536:QikeKhs7PNZvInX0Wbh8UH9SZ47Qn/ujOFAG5Ph:sxhyfAvH9SZ4uujQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2192-8-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3616-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3616-2-0x0000000000401000-0x0000000000404000-memory.dmp

Download

memory/3616-7-0x0000000000400000-0x000000000041A000-memory.dmp

Download