91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 16:53

Target

91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe
Size

93KB
MD5

030ea65eafb9d84f4fe591813e269300
SHA1

ab52f33d3169d65736279c092cb2eac45e9586fc
SHA256

91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535
SHA512

cdeb16afb241ce933753e70e8de6a5f6878417d7710b3ed3c837276617abb24652e3f19151a903cdf6ef4f2d73b7f10e93e0646f0a658b0608d8377e4c5fdca1
SSDEEP

1536:SP3DgM88ic7AIXw3Psvl+AfSofXGfN19D+2M2GAoUglcsddLtlQRHLYPyctT:GR8yl+jofXGfN1BnMJUpsddD

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1788	murzuja.exe

Loads dropped DLL 1 IoCs

pid	Process
1800	91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1788	1800	91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe	28
PID 1800 wrote to memory of 1788	1800	91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe	28
PID 1800 wrote to memory of 1788	1800	91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe	28
PID 1800 wrote to memory of 1788	1800	91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\91af61029748f2ab68a6c0d4ecd6b688de24e5c84aa4cced976bc44bf3e93535_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  C:\Users\Admin\AppData\Local\Temp\murzuja.exe
  2⤵
  - Executes dropped EXE
  PID:1788

C:\Users\Admin\AppData\Local\Temp\murzuja.exe

Filesize
93KB

MD5
588d688d776b3d61b23a71d9dc1a1b75

SHA1
331c0b6c3c0b7a84a16968130da72aca4d6f6774

SHA256
46209dc175147d9d22413aa67605499a5e6ecb33c575640b06babec262ac4afe

SHA512
284efbf1a56408928314b70fd4af4264fae9b816d76a95ca0bac420953af0c1ef39dbeef3cbc5fbebc8482d2191df895f42afe3dc9623e037c027b37916559bf

Download Submit
memory/1788-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1800-1-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download