eb9e9f6e932caf02450d09d3aa76be4ef9350b7bfeb4df5ede3443b6fef68489

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 09:47

Target

d87f35ad149483d7a547dbf1689b35a0_NeikiAnalytics.exe
Size

84KB
MD5

d87f35ad149483d7a547dbf1689b35a0
SHA1

56d1eddb7ba45183127324f6f0fdba1720ec2904
SHA256

eb9e9f6e932caf02450d09d3aa76be4ef9350b7bfeb4df5ede3443b6fef68489
SHA512

4198f7a78c5b4d9ec6b80afa833bbc186c2f36caacc525451eabea03b54982c2bc0e29fbaa5359b18b6436e6c06f9bf296a8ebdc9d4249443187b954a240ea27
SSDEEP

1536:TalEkKgJOyjc4oqULVJBoLmcYXV/O16nvaHWuY4Jyl45ycV7T:vbOHw5qLmcYXVlnvkuly

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
208	antifahib.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 208	920	d87f35ad149483d7a547dbf1689b35a0_NeikiAnalytics.exe	82
PID 920 wrote to memory of 208	920	d87f35ad149483d7a547dbf1689b35a0_NeikiAnalytics.exe	82
PID 920 wrote to memory of 208	920	d87f35ad149483d7a547dbf1689b35a0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\d87f35ad149483d7a547dbf1689b35a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d87f35ad149483d7a547dbf1689b35a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Users\Admin\AppData\Local\Temp\antifahib.exe
  C:\Users\Admin\AppData\Local\Temp\antifahib.exe
  2⤵
  - Executes dropped EXE
  PID:208

C:\Users\Admin\AppData\Local\Temp\antifahib.exe

Filesize
84KB

MD5
2b66c3294a24692d014247c8e4aa33e3

SHA1
792e72efe9be475c55ad87ab0f6cf227cebba1f6

SHA256
12f32f631e624575d5c3974bb6b0a12fc03a4e44a80375e322299ad6c42c114b

SHA512
fead15d4ea24b0c1d545cab03fe5d63003605cc0dd0161b8eaa9aad4d23fd2a61515250fbb295ade03dff6009d8ffa6c43834d7f474effe6bfbe1602e95fe7fe

Download Submit
memory/208-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/920-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/920-2-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/920-7-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download