8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe
Size

41KB
MD5

d6b468b71ccc55c6fcdec882bb3e5e40
SHA1

ab66f9822ac8c488b058cd3b515fc612410cdbc1
SHA256

8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02
SHA512

e709c67d685287eb94eb114bfdb2f18c8211f22d697d1edc698bd331ccf9c0ea44f1bca81214ca85c6339490d56b39c2526794bcb345b09909903447bb93c4ee
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/R9:AEwVs+0jNDY1qi/qX

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

316 services.exe

pid	process
316	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/664-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/316-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/664-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/664-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/664-42-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp7EE1.tmp	upx
behavioral2/memory/664-135-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-136-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/664-162-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-163-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/316-167-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/664-171-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-172-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/664-194-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-195-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/664-232-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/316-233-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe
File created	C:\Windows\java.exe	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe

description	pid	process	target process
PID 664 wrote to memory of 316	664	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe	services.exe
PID 664 wrote to memory of 316	664	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe	services.exe
PID 664 wrote to memory of 316	664	8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8d95aed73d72a12707133e55948710d53006bf452dd6b1662f4acfd244edec02_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QL6D63T0\search[3].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\default[2].htm
Filesize
310B

MD5
2a8026547dafd0504845f41881ed3ab4

SHA1
bedb776ce5eb9d61e602562a926d0fe182d499db

SHA256
231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce

SHA512
1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7EE1.tmp
Filesize
41KB

MD5
9dd0102940ed5f647525230e99d28102

SHA1
6fa186ae6295928a1443aa291482c5859cf0653d

SHA256
0a133463cb1e987a89d52d6f822e039ceea3145d0dbd4ec62849251260570e1f

SHA512
f08762f36bdac4cdbe5a7648c2e087d2f4eeed3f8932da49a866eee5d35f4265ea298e08f291ec4f255afc92a84899cf1d6c7bcad39c9a4fac13bef90a10b706

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
3a10f36df909fa7098ff83c301c07201

SHA1
742bdfcdca43897a2bba67573b5d1e854471943d

SHA256
79683c4d3737b7e490d20e554336fd9b3ac29838dfe776ee21d5399b9ae433b5

SHA512
d389cea329fd0f5a5e58a624ffd4e25af2bdb6f37c8525e83c901d8403ea2889faf041283df7250297f67dad485152b15b76272fd2c9912df4b914fb7912f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
106882fe1124f23aa768e1ac6b47a6d2

SHA1
41574a2f2f13a75bd05f5fc355d8d788de433699

SHA256
67881fadbc81bceed06e72d931bece106b649f72af3d0884e4ea48115d3b0b27

SHA512
7ac71aa436bfca4ccee7a9b2272cb3e03cfe871c331651d84cf4c8f07a799cfe600f5f120302dbb91aa4e5d4cc17d11a0505c34d581d82f04d9b674d5043bdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
6279cb4976f1b69ef21e58372de404c5

SHA1
eccf8d5215b8ee25bec7ef8569542730483cc23c

SHA256
02bb0aa3bc342ba0b3a210aca9033c5b65a4d0c24984706741153590aa86eeb7

SHA512
ee979781d746aeb9e66502ac5f409daae616e84c0ab74946181199c7804aaee6382e65e30b37f62aca579b30537dd2e247641d0aaac85b4a3eb8cdc5f656eb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/316-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-233-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-195-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-172-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-167-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-163-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/664-162-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-171-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-135-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-194-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-42-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-232-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/664-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download