391156a041106b29233f4b0c0a6f975977e848b78967af8cac9f7f652cdb9402

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 22:10

Target

959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe
Size

52KB
MD5

959cee3f56bc0e49fa55acdd8cd69aa0
SHA1

ca8f371f2d967752272dbe762eea5d44363d6227
SHA256

391156a041106b29233f4b0c0a6f975977e848b78967af8cac9f7f652cdb9402
SHA512

0bef903dbe4adf976943ae2e2fa9321883a1f1ace29fae7ef967598f25f6a00969cd2007dd299a5a2082a8fc9951e7c873f297cd46b691c07706fd578b842cfc
SSDEEP

768:0M7kP0swFY6cPf/t+Vin9rOHialu0+qiWiSM81rVZVUCkzWdt8JC:0M4P0soYB/Iwn96H/unXjErZjdt8JC

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1948	ofylywo.exe

Loads dropped DLL 1 IoCs

pid	Process
1796	959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1948	1796	959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe	28
PID 1796 wrote to memory of 1948	1796	959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe	28
PID 1796 wrote to memory of 1948	1796	959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe	28
PID 1796 wrote to memory of 1948	1796	959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\959cee3f56bc0e49fa55acdd8cd69aa0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  C:\Users\Admin\AppData\Local\Temp\ofylywo.exe
  2⤵
  - Executes dropped EXE
  PID:1948

\Users\Admin\AppData\Local\Temp\ofylywo.exe

Filesize
52KB

MD5
ae5d1653af5a112d71bd688ce10c9bbd

SHA1
c587f57666c9f841b76f5b51a0d25299fb7fa2d0

SHA256
cd29161e7a760ece22dfe19ad60b4833ecba33a8eb3c557e0bd76ba008eb4de2

SHA512
50ef1f57f4db8919a541041d7fe9b37eb3d49193fabfc217f7c2acd4eacc875789fca7f9cd0b737e707c028554245aab74c0d425fa16627aab80de1030077d5b

Download Submit
memory/1796-0-0x0000000000100000-0x0000000000102000-memory.dmp

Filesize
8KB

Download
memory/1796-1-0x0000000000E61000-0x0000000000E63000-memory.dmp

Filesize
8KB

Download
memory/1948-8-0x0000000000F11000-0x0000000000F13000-memory.dmp

Filesize
8KB

Download
memory/1948-7-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download