430bee5036ea98c40fef7ab5e229f74fd7761d5c72e2577a34384d2a179df88a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe
Size

566KB
MD5

cc45e0876705044d8e8e89f5e8a54820
SHA1

46f3ee68527694f57d265d1a6fdc28525fed6901
SHA256

430bee5036ea98c40fef7ab5e229f74fd7761d5c72e2577a34384d2a179df88a
SHA512

b09e7db28304d00a5831a338af3501224a79c04f9f14c9d2a2924828ffaea52010418032f710e0c0f2c3e5524b0410d67600a383ff1b892b7c375318cea63a88
SSDEEP

3072:4twizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOLlqw1aQuoYKN6LS12isv:ouj8NDF3OR9/Qe2HdklruoYk6LWa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
2992	casino_extensions.exe
1940	Casino_ext.exe
2184	casino_extensions.exe
2560	Casino_ext.exe
2644	LiveMessageCenter.exe

Loads dropped DLL 6 IoCs

pid	Process
2332	casino_extensions.exe
2332	casino_extensions.exe
3044	casino_extensions.exe
3044	casino_extensions.exe
2556	casino_extensions.exe
2556	casino_extensions.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1940	Casino_ext.exe
2560	Casino_ext.exe
2644	LiveMessageCenter.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2368	cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2332	2368	cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 2332	2368	cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 2332	2368	cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe	28
PID 2368 wrote to memory of 2332	2368	cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe	28
PID 2332 wrote to memory of 2992	2332	casino_extensions.exe	29
PID 2332 wrote to memory of 2992	2332	casino_extensions.exe	29
PID 2332 wrote to memory of 2992	2332	casino_extensions.exe	29
PID 2332 wrote to memory of 2992	2332	casino_extensions.exe	29
PID 2992 wrote to memory of 1940	2992	casino_extensions.exe	30
PID 2992 wrote to memory of 1940	2992	casino_extensions.exe	30
PID 2992 wrote to memory of 1940	2992	casino_extensions.exe	30
PID 2992 wrote to memory of 1940	2992	casino_extensions.exe	30
PID 1940 wrote to memory of 3044	1940	Casino_ext.exe	31
PID 1940 wrote to memory of 3044	1940	Casino_ext.exe	31
PID 1940 wrote to memory of 3044	1940	Casino_ext.exe	31
PID 1940 wrote to memory of 3044	1940	Casino_ext.exe	31
PID 3044 wrote to memory of 2184	3044	casino_extensions.exe	32
PID 3044 wrote to memory of 2184	3044	casino_extensions.exe	32
PID 3044 wrote to memory of 2184	3044	casino_extensions.exe	32
PID 3044 wrote to memory of 2184	3044	casino_extensions.exe	32
PID 2184 wrote to memory of 2560	2184	casino_extensions.exe	33
PID 2184 wrote to memory of 2560	2184	casino_extensions.exe	33
PID 2184 wrote to memory of 2560	2184	casino_extensions.exe	33
PID 2184 wrote to memory of 2560	2184	casino_extensions.exe	33
PID 2560 wrote to memory of 2556	2560	Casino_ext.exe	34
PID 2560 wrote to memory of 2556	2560	Casino_ext.exe	34
PID 2560 wrote to memory of 2556	2560	Casino_ext.exe	34
PID 2560 wrote to memory of 2556	2560	Casino_ext.exe	34
PID 2556 wrote to memory of 2644	2556	casino_extensions.exe	35
PID 2556 wrote to memory of 2644	2556	casino_extensions.exe	35
PID 2556 wrote to memory of 2644	2556	casino_extensions.exe	35
PID 2556 wrote to memory of 2644	2556	casino_extensions.exe	35
PID 2644 wrote to memory of 2608	2644	LiveMessageCenter.exe	36
PID 2644 wrote to memory of 2608	2644	LiveMessageCenter.exe	36
PID 2644 wrote to memory of 2608	2644	LiveMessageCenter.exe	36
PID 2644 wrote to memory of 2608	2644	LiveMessageCenter.exe	36
PID 2608 wrote to memory of 2724	2608	casino_extensions.exe	37
PID 2608 wrote to memory of 2724	2608	casino_extensions.exe	37
PID 2608 wrote to memory of 2724	2608	casino_extensions.exe	37
PID 2608 wrote to memory of 2724	2608	casino_extensions.exe	37

C:\Users\Admin\AppData\Local\Temp\cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cc45e0876705044d8e8e89f5e8a54820_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3044
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        8⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        10⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c $$2028~1.BAT
        11⤵
        Deletes itself
        
        PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
571KB

MD5
ff90e451e876bf30c97eac0dc03ab65b

SHA1
a1ecf4a03b12c92225ea8f4d26472d44ccc7b738

SHA256
d93136e44156efe19a29ae56342a58e16e6cf9e9846edbb3ebba1d0ccc7acb27

SHA512
d153b47ccc4dc8945b852017d5f0f8b40686fd91c08ad05d0563b257b9f1cc20e149ddacff7a3b111b9d597d28e659e42c6b3e2b3e5d91b0eeb0a9aab3e3bcd4

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
581KB

MD5
4d996b2eec31e3e5f16d3980bd9ed203

SHA1
b925165b6efd1a524bd93902a2ee083d66f69ee0

SHA256
3369023085c3709dd8356de3adb8c7518e1457668369e6b8b92cf43fbb30a1ca

SHA512
f2a5188b9c4fc2c705d3bbf0fb78a20746549fdcd3b4a6cdd42acb508388404a0ea6baed3121ba09b584d0883a32c65fe3d33bc75d74c80bc0ecd54cc523e72d

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
582KB

MD5
1b9a5fbc46abad1cdfbc2a86ac28135f

SHA1
6ab045e4fe4ad3757c61a88490a1650b6d97b192

SHA256
b0f4e118d5a1a678815ffb4daabe20ce9ce043b0a41b0e57fc1eff5c3b16e1dd

SHA512
c40b8528edca68260454da8968c9a478d24104cdcaee39f269c48b1889d40f4c86e9535ec5b686d8d8c955f7cdfa975b56a3236956de1ff3040503e1697061ac

Download Submit
memory/2368-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2992-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download