056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe
Size

41KB
MD5

0df8ad31e702a9026440d002389915f0
SHA1

2d98d30717112a3624ea942d4cc4cd38e08bf48c
SHA256

056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f
SHA512

22bbb2877f7113002a422a2f955c271a1d9c799550d0b7f2631d2d00c8bb2d8ea8a9a721b3777e0a350462ae36adec83eea18ae658c9461b956be51f36c007e4
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2796 services.exe

pid	process
2796	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/544-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/2796-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/544-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2796-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/544-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2796-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpF7DB.tmp	upx
behavioral2/memory/544-209-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2796-210-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/544-301-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2796-302-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2796-306-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe
File created	C:\Windows\java.exe	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe

description	pid	process	target process
PID 544 wrote to memory of 2796	544	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe	services.exe
PID 544 wrote to memory of 2796	544	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe	services.exe
PID 544 wrote to memory of 2796	544	056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\056ca7f8264059bc593b9e61664f0416acba0392e76ac68ad22f85c2a2ef292f_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[4].htm
Filesize
129KB

MD5
2df97b9e059c44ba21687286868f59fe

SHA1
96ab546bd02dc77a67f057b0a040c008fae30f0f

SHA256
f46cbd024f6b57db71491df8c7e42aabef92698a6c04c736a8eed94538b0ac94

SHA512
8f49c05aae1c70852a0dc718e1d1fa559173b003b4cb6bcac7094ba0233995d4cbc90ce1716224c85116f21aaaaede48bcb12992d8cdeaede1eecf5139e1c180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[5].htm
Filesize
121KB

MD5
036267282cb741557c370f867c08a6b5

SHA1
74cfde3f0f4bdfcd418c5607cc3ddaf6a58afe7a

SHA256
4eab071230126d1c3348d152926d8fab5e0c4637afcd5d6dfb3b7261e92bdf6d

SHA512
dc69953fa937efa0f09a79f1cf50a6799cda6430ec92e3234f28601153b44980ab57a87af10dd12bf0c657b06005f4c7abeb933012895b30a1573897bd616bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\EIARVWXW.htm
Filesize
175KB

MD5
6dc253e99de1ac1c6980b3602ed7bd1d

SHA1
c72a0fd4faf2f5bcc2006800e5fb6ee90a1d4124

SHA256
a21fc1faf9bc972878e092727a5bfce702c55c229cc755b52d0c9c139685795e

SHA512
0cbf04d01b052a05b6cf3afdc026168bf037fd079f8a7f95365dd97a2988ac7192a510e5fb66734db3af9f4d300b44001d336496e9024300549e67dffec3ce68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[2].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[6].htm
Filesize
138KB

MD5
c4c8ba5f8f88639adbcdfb6f7491dee8

SHA1
bb1f7df51fd78c094c8c236398464cdd24ef189b

SHA256
dfdf5d654365e5ecda48fd5245ceb3d8e686b04713640351170f3891d6ee48e7

SHA512
3f364d0aa64f204e981a086078829748b0738db517aac71163fccf210fb430ec6f232d93dd6bdf5f57530b1edf063e7e3b1b662d0019dd9a7908a872f72c72b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF7DB.tmp
Filesize
41KB

MD5
2ad5be7983cea45fe76488c62c4fa96b

SHA1
efa0e1b8be21814b98838b365b7fb96778335de1

SHA256
ad324ef138a412b36f28d270a25943a3ee9176e8f3433bf1fa7d6e556b14ab2c

SHA512
815c987dd72de0282913e035331b18ed4da711c4a297003ae19ec703335d6c03e8bdd2687f9ec69b3bf5a268def00a86c314a5b69ab995de046dbeb24a37dfad

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
970c84cbc5547f337a26467c792d3a3f

SHA1
49db85777558cb94ef970bfa1a44c45998445e53

SHA256
39a92e1fced98b0b95ad17becd9c0f89d50f9c824ce385d7122ea160aedc5e3d

SHA512
2a7d4ba39eb2876df682e52be69d254b3d534296fe700a566243c270a71ddc8f8af1eb00153959ff84fc116d3929774b5ea276a9161b6fef63b73218a4ee0880

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
e84f74808ddaa2bc8d3eff6d6d32629f

SHA1
eaa290bb0962e7e5a96d1e358ad72746622dfa43

SHA256
ce35bc1704ad83399c5eb2c951eea21820e22b802d9396bfc9679b01af81daad

SHA512
3eb5aecd5e53a170d2538436fefc0f09e43b7215f7a0275816385d99fba599e251888006a0697256a0c1a14175724944c235fcfa86461b1f5a4d1a24df9fdec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/544-301-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/544-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/544-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/544-209-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/544-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2796-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-210-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-302-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-306-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download