115d7055afbfa3cd5fcbef559fafb6bb4be68853fce2858331d158630f25f823

General

Target

9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe
Size

928KB
MD5

9b78adad59c45eb1c89d81125001eed0
SHA1

87fad15c99c4ee7645f30a062e7e4e390ce19eb4
SHA256

115d7055afbfa3cd5fcbef559fafb6bb4be68853fce2858331d158630f25f823
SHA512

0ca9b53f1fb5ee70e826d7177b07fe71af2a135819d8e0692ec421f1f798d4f25f13ba53bace87b0fb86ca3f4a113b2fe2bd68933b66940b6d647b38e1ec4898
SSDEEP

6144:Ouj8NDF3OR9/Qe2HdklrSqjzQtJnjqno2k29eLn4:xOF3ORK3d9QzQtJnjqno2k29F

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2260	casino_extensions.exe
2396	LiveMessageCenter.exe

Loads dropped DLL 4 IoCs

pid	Process
2264	casino_extensions.exe
2264	casino_extensions.exe
2704	casino_extensions.exe
2704	casino_extensions.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2396	LiveMessageCenter.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2104	9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2264	2104	9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 2264	2104	9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 2264	2104	9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 2264	2104	9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe	28
PID 2264 wrote to memory of 2260	2264	casino_extensions.exe	29
PID 2264 wrote to memory of 2260	2264	casino_extensions.exe	29
PID 2264 wrote to memory of 2260	2264	casino_extensions.exe	29
PID 2264 wrote to memory of 2260	2264	casino_extensions.exe	29
PID 2260 wrote to memory of 2704	2260	casino_extensions.exe	30
PID 2260 wrote to memory of 2704	2260	casino_extensions.exe	30
PID 2260 wrote to memory of 2704	2260	casino_extensions.exe	30
PID 2260 wrote to memory of 2704	2260	casino_extensions.exe	30
PID 2704 wrote to memory of 2396	2704	casino_extensions.exe	31
PID 2704 wrote to memory of 2396	2704	casino_extensions.exe	31
PID 2704 wrote to memory of 2396	2704	casino_extensions.exe	31
PID 2704 wrote to memory of 2396	2704	casino_extensions.exe	31
PID 2396 wrote to memory of 2676	2396	LiveMessageCenter.exe	32
PID 2396 wrote to memory of 2676	2396	LiveMessageCenter.exe	32
PID 2396 wrote to memory of 2676	2396	LiveMessageCenter.exe	32
PID 2396 wrote to memory of 2676	2396	LiveMessageCenter.exe	32
PID 2676 wrote to memory of 2760	2676	casino_extensions.exe	33
PID 2676 wrote to memory of 2760	2676	casino_extensions.exe	33
PID 2676 wrote to memory of 2760	2676	casino_extensions.exe	33
PID 2676 wrote to memory of 2760	2676	casino_extensions.exe	33

C:\Users\Admin\AppData\Local\Temp\9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b78adad59c45eb1c89d81125001eed0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
      "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        6⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c $$2028~1.BAT
        7⤵
        Deletes itself
        
        PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
942KB

MD5
0c16a409f7f8ff0bc6b3d4973991e8b8

SHA1
50e93e0fb1e853e404d7ea0e18618c04cab22862

SHA256
b9f33da3d9ee764e0e23adfc8dcb2a4f21531edfa1891b7755ce68939f8f09d9

SHA512
41f38b2d7e2db7370a99e80f68a41447665e6188f3398b04e68910a82f9dce5b74c79abfd30a5b0bae5e31c0b60f6905610a9bd717e7c9fb0bc297e8be0db455

Download Submit
\Windows\SysWOW64\casino_extensions.exe

Filesize
943KB

MD5
bdf2d15b424f029827274f1ed792bec4

SHA1
a4f863203bb813e1a0c7991b21fabec61cfd0ecf

SHA256
3ff25b5c3bf01cc6b62313d566dfd5122bd6303659dc48c5a4e18c3232ffb1ad

SHA512
67957de542cfc1457fd490c791aeae3ffcef5c607bc31ac0d3b403de9fe5c56a9e27df6a5021922d82056d6e6dc0b78d01457f6223084aa2775836c1450f8447

Download Submit
memory/2104-20-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing