a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
Size

528KB
MD5

feabdf1bbb4e187f68bfe9fe052ab4a0
SHA1

c1317132081d1dafa377a3c731896f1dd5adc171
SHA256

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7
SHA512

4005a42d62ad0fad9495b777d461249065446237085d69bdc4c490076f0b63d5a8e84f72c837d88524d4c9af9bf721a9732d1959a4573f944f4b72829dda77ba
SSDEEP

12288:iMsme5xls0JbES52oFywx4QTn1QgrYNbMqVpYWf:ImW60Jbx2oFyvQTn1prYNMwX

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2208-2-0x0000000000400000-0x000000000057D000-memory.dmp	vmprotect
behavioral1/memory/2208-0-0x0000000000400000-0x000000000057D000-memory.dmp	vmprotect
behavioral1/memory/2208-6-0x0000000000400000-0x000000000057D000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

pid process

2208 a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

pid	process
2208	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.2345.com/?28879"	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/?28879"	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?28879"	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

pid process

2208 a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

pid process

2208 a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
2208 a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

pid	process
2208	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

pid	process
2208	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
2208	a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a248656caa9a7eb086ea885d3240f9ff25d066e2951b6ee5325458e8f35d82b7_NeikiAnalytics.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2208

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-2-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2208-0-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2208-6-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads