cbf039a8a55b60f2a4bc438dc67484c348b8c964f0d34872cec13647a266c8d0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 00:17

Target

6ac02dc01aa97839aa3a6f6919bcb190_NeikiAnalytics.exe
Size

488KB
MD5

6ac02dc01aa97839aa3a6f6919bcb190
SHA1

9c26bee47900e760cacfc132f5d67e097161d58e
SHA256

cbf039a8a55b60f2a4bc438dc67484c348b8c964f0d34872cec13647a266c8d0
SHA512

a6fc730adf4ef0cd70a4b0af12cbe914b3b7861bbd70b78dd8a52ad569fa5428aba71881a39d698583ff34bcb4210a394e75ec62aafc2508e45cf59f6c3c7752
SSDEEP

3072:itwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwvwK42i1ZKEJAl9ur:Wuj8NDF3OR9/Qe2HdJfwK4DdW9s

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3036	Casino_ext.exe

Executes dropped EXE 2 IoCs

pid	Process
108	casino_extensions.exe
3036	Casino_ext.exe

Loads dropped DLL 2 IoCs

pid	Process
868	casino_extensions.exe
868	casino_extensions.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3036	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2992	6ac02dc01aa97839aa3a6f6919bcb190_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 868	2992	6ac02dc01aa97839aa3a6f6919bcb190_NeikiAnalytics.exe	28
PID 2992 wrote to memory of 868	2992	6ac02dc01aa97839aa3a6f6919bcb190_NeikiAnalytics.exe	28
PID 2992 wrote to memory of 868	2992	6ac02dc01aa97839aa3a6f6919bcb190_NeikiAnalytics.exe	28
PID 2992 wrote to memory of 868	2992	6ac02dc01aa97839aa3a6f6919bcb190_NeikiAnalytics.exe	28
PID 868 wrote to memory of 108	868	casino_extensions.exe	29
PID 868 wrote to memory of 108	868	casino_extensions.exe	29
PID 868 wrote to memory of 108	868	casino_extensions.exe	29
PID 868 wrote to memory of 108	868	casino_extensions.exe	29
PID 108 wrote to memory of 3036	108	casino_extensions.exe	30
PID 108 wrote to memory of 3036	108	casino_extensions.exe	30
PID 108 wrote to memory of 3036	108	casino_extensions.exe	30
PID 108 wrote to memory of 3036	108	casino_extensions.exe	30

\Windows\SysWOW64\casino_extensions.exe

Filesize
493KB

MD5
20c10d07dc746604885b6552bb330b40

SHA1
e7096d3587e3fe1c7a72b73392b0091861585614

SHA256
b63f1dd2fbccf0f21106695eca4f75310e16012dff6b6e3272205d08fdbd0092

SHA512
345f26839a6d43f083ad7639e05bda4034710acb12c444b9d92beadeb2cd568c9bf17b3855097311078585ea802210c4bce1c76cbe7815dc47f966ecfd3dfde8

Download Submit
memory/108-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2992-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download