b0483d40a4a1b3090ea968302a0ca5cdf32d2edf35e736f4116f7ac06eae3cd1

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 16:23

Target

db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe
Size

75KB
MD5

db92d2b50301e5a7c1d01a6151ffb190
SHA1

1cded579f5c351ccc6f958a6a47d2acc963df9f9
SHA256

b0483d40a4a1b3090ea968302a0ca5cdf32d2edf35e736f4116f7ac06eae3cd1
SHA512

4bd7650dfb99d9bd3fdb5a9f473490feef528c34e3f4dd7338cc5f1d1c14d2cba9f024912265533ad1eeba734287f4c894fa250a785bf7c56d692ac55788cf21
SSDEEP

1536:0M7dHk0kFE2XtPIPtBovZck8OMvDgDcdOOKOBfL924xRz/srmRJ5:tJ7tBoKOuDg4dOOzhL924Ir8

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2240	olacweegim.exe

Loads dropped DLL 1 IoCs

pid	Process
2132	db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2240	2132	db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe	28
PID 2132 wrote to memory of 2240	2132	db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe	28
PID 2132 wrote to memory of 2240	2132	db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe	28
PID 2132 wrote to memory of 2240	2132	db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\db92d2b50301e5a7c1d01a6151ffb190_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  C:\Users\Admin\AppData\Local\Temp\olacweegim.exe
  2⤵
  - Executes dropped EXE
  PID:2240

\Users\Admin\AppData\Local\Temp\olacweegim.exe

Filesize
75KB

MD5
8667a647a70f41516566ae0980aef35a

SHA1
23dc6e7bfe97c2475b192d6f4c4a382d71fb3ef1

SHA256
603c145e30527aa63cafa3fb8ed5b30b361da10755a992ec4e2e1bf31dc36ec4

SHA512
47ae44fed538866830c39c004033ff9ecd1f263421785505ae1b0ff77415296975dbd959ed09c36236479b20d94fe37a22bfb4bbb2f6da7a5348b5b9d6b766e6

Download Submit
memory/2132-4-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2240-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download