43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c

Analysis

max time kernel
118s
max time network
154s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe
Size

41KB
MD5

0b326afe40b709dac6aef9a2d3a93a40
SHA1

cf317f43f4e42510e4994f32cc650a3ba0dd822f
SHA256

43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c
SHA512

4b181d564cbaf25298bdf6c88226921eaea71ae0791f78e4be7e802c93d8e37119f64bcd48d61d9c8d7728dee3e0573e64f79e26fdcd772021f08105da92371c
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1540 services.exe

pid	process
1540	services.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2208-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral1/memory/1540-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1540-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1540-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-31-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp1F26.tmp	upx
behavioral1/memory/2208-53-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-57-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-58-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-59-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-64-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1540-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-69-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2208-71-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1540-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1540-251-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-250-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2208-375-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1540-377-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1540-445-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2208-444-0x0000000000500000-0x0000000000510200-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe
File created	C:\Windows\java.exe	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe

description	pid	process	target process
PID 2208 wrote to memory of 1540	2208	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe	services.exe
PID 2208 wrote to memory of 1540	2208	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe	services.exe
PID 2208 wrote to memory of 1540	2208	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe	services.exe
PID 2208 wrote to memory of 1540	2208	43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\43ed998770895a0c7c0852726e12ff68346a60d0d7eeebed85fe410c9e076c8c_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f33ce6044cee8337c46e04f36e7f6bce

SHA1
0aff87b298c867e59ab43cf896e52eb8c4ae5355

SHA256
819bee81d7a7d06f30fbbf66965f1741e051e4f002062cc58f5cf6209840907e

SHA512
6a36c99be6c269175910447e99a3bf67ed199d304844ae008d92d09c0a1cd876092f9f421dba61057f366d7ccde0a5c7e2035624be36e79d86d3ea50eb5eb08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d0e83dfe365425b8475dc5caa490c418

SHA1
bf3e817e757da2e2ad1477e1ae66aa90fb0c96e1

SHA256
540e3b75f6a0c268c04c5227e9ed1f3b6f70e5d7bfd681239bec599bf7bc5154

SHA512
1466d2b4fd3830880b415726bd53ae9afdbb30a182e8ba467be72ff7b90c4e6c7da0cba97fab8e0e7da64ee02d4c070e79e87d56b374048e817b398246f9cb6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\ZJG3N4LL.htm
Filesize
175KB

MD5
0b63f2a782468a51e128b808e57faab3

SHA1
388525cb6feacfb71baac2a9482ad40de92de0f5

SHA256
e100df39b2256dc6e46a4a5ff672485765c2555841c1943b464f0d49b766d261

SHA512
53ffaa3fb679953532314d2d67e0404a1326b7eca2f1ee6df871fde5cdc4e3bee8be3f8441e122c740625b1e22ff50ff38b43e893de6269274df697ce4b6c828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\search[2].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z5LT06Y3\search[8].htm
Filesize
172KB

MD5
91e7c9fe016089b48723143a201123c8

SHA1
c7f1f1a82b2625e1ff027dbd2ecd97feeb2cf3c7

SHA256
40a312ed2d1dd458c09211160ac0dc2dafacc807e6e31b26796c1c32d317595b

SHA512
2ac6e12b5824f4b82e1ed8f4ad06313398c014990809c8a1b5b5f5194092e694a77fea0c33f7308b3913a2da8175b83c9ef68ef8d98e3fea6b53029d4b3d9939

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2601.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26A1.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1F26.tmp
Filesize
41KB

MD5
88da6601eaf55313689e72832e6338d6

SHA1
e3f9f3c726d388e79c5b6cc834c7d616d8f2eafa

SHA256
57820730dfac0a2648fe83d7e858d3f328f569bb1dee4e4dbe55845c3b7c7768

SHA512
b9b6f45b7fe79fab0f88cafe929f04677a27978aa802e84a2780e80be7a6c0c57b881437505272dc887b1398d1e55b51398eef6514b8c2837d0a5b4db6294160

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
8ab8d5efc26d47a4727e9b07f0ef2459

SHA1
417232d004a796189910bd6021774224b5b55e40

SHA256
a9055a771f7c15856ba81e3aa1e83b944621b242a57e9575cb2301fc5db0f21b

SHA512
37e7bc1cd64a1a03c427b20f7a0ed24cfccdfc52fe263f088f80b7d857b2d1847e6f370fb863be8fc5d4d8255e2c5e12ed7a692d53b3a2e6864a3b33f9e82599

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
7fe016e427b1908e856dbb54197956d0

SHA1
78cd03d5ab4551af137c7680445e7f6711288adf

SHA256
19e1d8c18404e9dfc4c4b8f1b0d2aae2106aa7b87022f71ca81417d2ae0ff3e2

SHA512
981bccb33d488899761fe205c2bc372cb8af746530041083f025e336f6c9d3419829d55ef24d60224e8606d2103fc84dbe3e538c9c698913470e3921f5254584

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
5f60b59db10405430ee720ce4f212ed8

SHA1
f3d664fe6cd0af9430dc66870a4842e8c4be19a9

SHA256
2799d342443ef606b49825a2e9ca2b2827040d3d351e220b64ea3097663346ce

SHA512
b54a0f7378534b7497e548bd404fc4e2e7564fa5f63fdb6b99268bb154058b6a37d13ad5e251387b46ee19f2be2507633fc93b3c0a828a66d89f40e34f29a87c

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1540-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-445-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-377-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-251-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1540-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-250-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-71-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-64-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-59-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-69-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2208-375-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-57-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-53-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-31-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2208-444-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download