e6f2fbf8685066aec229883ef72cba76f3a271f9006729e2a62fe400a9fe8d17

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 20:50

Target

047b6541185443cc6a627648f7453330_NeikiAnalytics.exe
Size

90KB
MD5

047b6541185443cc6a627648f7453330
SHA1

7d0a51ee6f4b8466e8991fc88557416e7abee0f3
SHA256

e6f2fbf8685066aec229883ef72cba76f3a271f9006729e2a62fe400a9fe8d17
SHA512

a6095048f9c86f606101596c39d1168cb755c19865f312cf6bf76ce0703d502feab028bb9b66796228a8e95c84dee638395d73f0a93379e0ce9f69d49c766876
SSDEEP

1536:UN5O9mncLg4eQHPktA+tdmQXQKNZQMvYf6rUhU5TiB5Z6CSIc:UC4A+2QXQKNZzvHU0J

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3708	izilysa.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	icanhazip.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 3708	332	047b6541185443cc6a627648f7453330_NeikiAnalytics.exe	94
PID 332 wrote to memory of 3708	332	047b6541185443cc6a627648f7453330_NeikiAnalytics.exe	94
PID 332 wrote to memory of 3708	332	047b6541185443cc6a627648f7453330_NeikiAnalytics.exe	94

C:\Users\Admin\AppData\Local\Temp\047b6541185443cc6a627648f7453330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\047b6541185443cc6a627648f7453330_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\AppData\Local\Temp\izilysa.exe
  C:\Users\Admin\AppData\Local\Temp\izilysa.exe
  2⤵
  - Executes dropped EXE
  PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4776

C:\Users\Admin\AppData\Local\Temp\izilysa.exe

Filesize
90KB

MD5
b44d5a1be6c779e1dd36798a88eb70b0

SHA1
3d358810ed491b3996509864f08de7595aeeb5e9

SHA256
b8a9c32a9e178c99de9b6b784b706feee87d613c264da6c9a4c3a38a30817902

SHA512
af4828c3b147df1a93a82cd4e43b2ed55883e0c3320dd3c96dab55dc25d082e95bb1fcccdc16be39e5d37639788a28bc868f4f99d2750f31dc38315707256622

Download Submit
memory/332-0-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3708-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download