0ab664af8e4b78f6dba2e5900780712d51d49ec50e502596595959b8f9894f2f

General

Target

7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe
Size

570KB
MD5

7402040f6536e370b9ef36f8a4cd4ad0
SHA1

82628abfabbd2743b151bec3092e3869f461a814
SHA256

0ab664af8e4b78f6dba2e5900780712d51d49ec50e502596595959b8f9894f2f
SHA512

745826888a4ad7b44ded60923c0ca9785fa7e63e774464caa75e4ab54715bfea978c5b9bbcdd21b66fbf8ecfa057583f5c925c608b9a342cde0005ea2fe0263b
SSDEEP

3072:vtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOLlqw1aQnjQ1F4AE4v9tihxM:luj8NDF3OR9/Qe2HdklrnsKM

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2600	Casino_ext.exe

Executes dropped EXE 4 IoCs

pid	Process
1948	casino_extensions.exe
2236	Casino_ext.exe
2052	casino_extensions.exe
2600	Casino_ext.exe

Loads dropped DLL 4 IoCs

pid	Process
544	casino_extensions.exe
544	casino_extensions.exe
2772	casino_extensions.exe
2772	casino_extensions.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	Casino_ext.exe
2600	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2792	7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 544	2792	7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe	28
PID 2792 wrote to memory of 544	2792	7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe	28
PID 2792 wrote to memory of 544	2792	7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe	28
PID 2792 wrote to memory of 544	2792	7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe	28
PID 544 wrote to memory of 1948	544	casino_extensions.exe	29
PID 544 wrote to memory of 1948	544	casino_extensions.exe	29
PID 544 wrote to memory of 1948	544	casino_extensions.exe	29
PID 544 wrote to memory of 1948	544	casino_extensions.exe	29
PID 1948 wrote to memory of 2236	1948	casino_extensions.exe	30
PID 1948 wrote to memory of 2236	1948	casino_extensions.exe	30
PID 1948 wrote to memory of 2236	1948	casino_extensions.exe	30
PID 1948 wrote to memory of 2236	1948	casino_extensions.exe	30
PID 2236 wrote to memory of 2772	2236	Casino_ext.exe	31
PID 2236 wrote to memory of 2772	2236	Casino_ext.exe	31
PID 2236 wrote to memory of 2772	2236	Casino_ext.exe	31
PID 2236 wrote to memory of 2772	2236	Casino_ext.exe	31
PID 2772 wrote to memory of 2052	2772	casino_extensions.exe	32
PID 2772 wrote to memory of 2052	2772	casino_extensions.exe	32
PID 2772 wrote to memory of 2052	2772	casino_extensions.exe	32
PID 2772 wrote to memory of 2052	2772	casino_extensions.exe	32
PID 2052 wrote to memory of 2600	2052	casino_extensions.exe	33
PID 2052 wrote to memory of 2600	2052	casino_extensions.exe	33
PID 2052 wrote to memory of 2600	2052	casino_extensions.exe	33
PID 2052 wrote to memory of 2600	2052	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7402040f6536e370b9ef36f8a4cd4ad0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Deletes itself
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\casino_extensions.exe

Filesize
583KB

MD5
5736e421c2ee03a243af6e7aaeba983b

SHA1
bbb76b2d26a0f8ae9e2d0e86756a1a0fca8f0cd1

SHA256
7142fcef2bf56e7dfbc6fbbfa9e930e9af26d941b9ef043be52f72e7b003a191

SHA512
53a684dfa47d438b20c1eac42cdb43eee04bfd35526ba643cf97779e2a25eeaac33883bac86f1139a072b83fc55ddb00780dd2894e5c260a1815f4b7b17acadc

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
580KB

MD5
f6b3b90b5661110c00846d4d817b8923

SHA1
3f0de41807f4c067225c374c3f695952a9e404f6

SHA256
aa5a68e195a787d80307b15a1a1f041cb4b3341562b3b7a18c627a9eb7e9f3c2

SHA512
6425b3e1c2e5ec69b6c74aeeb658aa86025bc805697a5f99f8f61dc76ad4903b23e0a10a6564a8c1d0987d00817eb86e67ef4847b4332bb53e08e07bfb71594d

Download Submit
memory/1948-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2792-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing