0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc

Analysis

max time kernel
65s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe
Size

41KB
MD5

f86696d3bf47cd6e54b6091552ddfbd0
SHA1

f18387b58964b72f4acdfebcee8e5bd412196412
SHA256

0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc
SHA512

64ba3396eb6a50ec0d72b8979b5c0828bb618023113a0578d3e3ad40904011910aefd09274d3b48c451d6bed84effe996e081fd969982dea9c1e5548cc16fb5f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1928 services.exe

pid	process
1928	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\services.exe	upx
behavioral1/memory/2424-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/memory/2424-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1928-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1928-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-29-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpEA23.tmp	upx
behavioral1/memory/1928-59-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-58-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-60-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-65-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-71-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1928-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-72-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-78-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1928-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-138-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2424-520-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1928-521-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1928-526-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2424-525-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe
File created	C:\Windows\java.exe	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe

description	pid	process	target process
PID 2424 wrote to memory of 1928	2424	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe	services.exe
PID 2424 wrote to memory of 1928	2424	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe	services.exe
PID 2424 wrote to memory of 1928	2424	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe	services.exe
PID 2424 wrote to memory of 1928	2424	0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e75198658cf206fef1240057e62b7e90dca5de377ab9f5d6649aad84c26a4fc_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9a52cac3c82666f886234b61507288b0

SHA1
d7f9b61d32064f1a4135af1d72c58be9de13581e

SHA256
05143a382083d0f01265d221d31be6947fcd97da8499e4e78dc935605d030c6a

SHA512
ca03cb889f9dc11c512f3be55c28e1a1b5ebdfff4e172b87ac324141488cd2a99dfb18e4ab699c244638e2627e6efcdc315546a61bc465efe4e0c1e7a116d54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\search[2].htm
Filesize
120KB

MD5
046a6368ff49e5d5e8e1eb8a692fec30

SHA1
24bfa565894751d3de8ca404a2c20444084834cd

SHA256
07b5269074a9353ee55bfbbe4f1ed7d004d593aa749b445747b11a039beee4aa

SHA512
f7914dad8ba400008bbbee28606524f879d183d906e75e8190c2dea92db5995086b94348bc236587b1b0bc4ffe4e03871a074db150d4fa44fc9c5eb330ae2870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\search[3].htm
Filesize
114KB

MD5
cb9b90117f14339627dd24248bf4e21b

SHA1
f505b2de37906685026a504aefb242fb10456f86

SHA256
b84ac8daf23930b8bb2ea66f47e5afef3b81a88810e38199370d2e8acd18fa3f

SHA512
b9023d96fa62729da906e6a3f2799122332283717f09d597864f9f6bd86d1ea27c80f0b09850ed84c758616132768ef4af6509d0fe87f9a45b35b655fff37bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\search[6].htm
Filesize
137KB

MD5
acd969e4e7a88f6d80b7e4a0c40bdc39

SHA1
a8504989dd636801c8d6734c702368893734fcb9

SHA256
3fa380917b8323e6a071c8c9e5e869ebab1e3ff14045f37c0e6db1c1593085fd

SHA512
030260886b3908a1ae94ba2fbf43a0ae80ac1790bef8942198a397442618a991d4986b651f0ce68c82b9bc59d4ea6f5d3e928fefa0dee188236029c46be48d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\AVCSHZG7.htm
Filesize
175KB

MD5
13109ff0f91a557d2f765ef0236736e2

SHA1
e655c0de938e168276a461b669aefef51b047cea

SHA256
3b4f5c33c21a165984b2cc856feb612a8afe93e8581f677038f23a95d197d051

SHA512
d681f238b662a1e4bf47525dde5b552312b7cdbab6dac256c017b5b11bf05bc0153fec50e65813bdf319101c75306fdccf1ddbcca99376855f3cec5db206f5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\0KV5NVB0.htm
Filesize
175KB

MD5
e93e2f104d1a14449385bf3d8c8a0175

SHA1
0e8bdbe65229accbb928458c92ae63310531fc29

SHA256
c6f024e6383322820c478b1062e2973e381b6ca40d68a06d0d362119bcf0ee48

SHA512
1ce412c28bdf3e582785a79a8c334786443c3ceb0bd7a7c44eedb3bb223a1686a75f6b161608da976b57405d6f8ac8404f2a1299b32c4dc4068de744ca58ffd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\search[2].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\search[5].htm
Filesize
141KB

MD5
e5fac9bdaa3fff032b550e2fd1486a0e

SHA1
37814eef5449162f187c6b692656c1edd50fe41d

SHA256
ba49f126ed2fe906b83a5b8f58d70cead480f8e63527b47fdc43d245000362c3

SHA512
751a64ee0905f334b84e719c3a9dbba9ead4937acc2b40e03fd53cbeb6466f9fb33849901e2e174aaa66d33397e49528cc48e088d8e036c7e3a6f280ab850a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF034.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0F6.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEA23.tmp
Filesize
41KB

MD5
b18aef811dc54fff6d82b18cc344d743

SHA1
bd6eaab1c4fdebaa0104ca47e96167092ddb609e

SHA256
2a1ed9699812f2d4fc7dcf3006abe2b0a9341a148cd1318e2f22d9c15c68f6d5

SHA512
8feb7acea91d08798a230510757bede178c08f2b8b7a37b5b8a1e9ae79fbcdbd459f1d482f0f63a3013849041e4850777ac1a577c629032c29776ec0d9b588f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
62f34c575f0805da6e4bb7aaa1c23e75

SHA1
30f59abd2b54ea98ed8b3e6b1728f7b13939c8ad

SHA256
49136b1c5c27028304688ada111dab7ddf9e3f6eb8c5bdd2bb2952b702036312

SHA512
2dec52ce7627ed64710f686ce0055754d072af8c7d7fa2974ffd9a7757d31d68d901ffd8187c17b0b26fbe22e996599055789b6637604a17fdc82c17746649ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
0b68d59f770512780524f53d3e20a525

SHA1
7b98138e017b2125bd149b536e8ce456d970d724

SHA256
f3e00dbe98b3c6c7f4f666ae58d2b653f29a260416e74681d653532b903c9f17

SHA512
4abba5e2a2a7d966d5d36f389c70158165d68825bc76bfd027edea5da92d6df83d0cea7471021f5ab50c6633de565fc0f5161926486ac49d4afee5be277e4b28

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1928-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-526-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-521-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-78-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2424-72-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-10-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2424-29-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-23-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2424-138-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-58-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2424-520-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-65-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-60-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2424-525-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download