45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
Size

42KB
MD5

3a4e6f22a46b5376d1a5a522701333d0
SHA1

3fd76881fa6949be3d7b79677b31eefd9443f932
SHA256

45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e
SHA512

9daaf382d9872fc9ca149f6ae9842e7d889d9e3e2460aa12883dea2ddddbb3768f4c0a87df325ab7ce4b482a592dce3dc0a7acbf687de2a5659c16f59ac4ba41
SSDEEP

768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVwB:tdAkXGqECcwYgw9PNSa0GXB

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

752 services.exe

pid	process
752	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\services.exe	upx
behavioral2/memory/752-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-164-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-248-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-251-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-252-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-309-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-483-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-503-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/752-506-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
File created	C:\Windows\java.exe	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe

description	pid	process	target process
PID 4632 wrote to memory of 752	4632	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe	services.exe
PID 4632 wrote to memory of 752	4632	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe	services.exe
PID 4632 wrote to memory of 752	4632	45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4632

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\search58ZP0SPG.htm
Filesize
114KB

MD5
f5af1f074b690578a68571c0d08ba70f

SHA1
116a62f6d625c5a60547c8239e791254b08c98e5

SHA256
8361bc1c5ee6c705881e3253138037f3426b3ebe5ce4b32efc70cb87c5a41fc5

SHA512
9a7e73538037fecf38e05dec304101425eeb3df30c1250d6cdb01bdbb7178320c8a62634b5f58c80fba57f7fcbd77be084ed4329b8ad9a8d58a330903e2154c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\searchO2CRPEXX.htm
Filesize
126KB

MD5
a22b20887a0117606da52a61725b6454

SHA1
504911ac1a5c96c5cdaa0444515c56060f9f54d0

SHA256
dc986ef7f8bda70861f7e1d988d64210a1d49019dd113423c98cf5b7d88bce97

SHA512
4a5e818178dd3310eb33e12a4ab0f76d488e588cf6d765f3a059001fb9b28eae8a5e10bde4fd3e3834af3036ab9457a4f6c6d810db5fedda2c7d3edd2184b111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\search[1].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6TQEXKX3\59UV56W8.htm
Filesize
175KB

MD5
c525b0ff96aade0df093ed4cd4ec3582

SHA1
187481af18bc4be135a2d908d10c30b15c684d15

SHA256
b657cfa77479ca17618b01ea130f8ed36c686cdf49559354f8fd1ca9daf8c9bc

SHA512
333364c89f95970f02eb5bd14f4f996a4015c4bb9825cca2b07095fad8bcf32cf4b6f1513bb43e8fd7eaa8cbe86476306773de3357e9ce975a0b0222358813c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6TQEXKX3\default[2].htm
Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKWDYRX8\search0F0HW5TN.htm
Filesize
138KB

MD5
8469ec58211d3ce2a4c85fbc30d08963

SHA1
1e938be827acfbdbce0168b20d4364fd0a0ccba0

SHA256
af1370bb047db36f53da34707d93e0da5c9d12684ca4427a66fcca71d9bb6365

SHA512
20597df1beed0cf252b3055336b7f6610569416aafb23c19733a9f361b41f6261ed2c0c751d2533d506ee8c87568e68e283c9041f102190d444a33b71d4ab1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKWDYRX8\searchGFR12UTQ.htm
Filesize
121KB

MD5
6e5e2fc5d2fb5371fbfc93d9d5d3d286

SHA1
b7e52031aac23127fc9e1ff2d086da778ca9ae98

SHA256
b22ac09cdd7d423393670c9589d1c18f74916e4fe388355443c8de452b9129d4

SHA512
afcad4e39d53f287cde80d0e6bf6329efed7035f9b010c69034046a282650ad18735d7e636db5d02eb8e65b85ca88dd463f1bd8c0f4c7fe9f8473aecc0d574b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\results[1].htm
Filesize
1KB

MD5
ee4aed56584bf64c08683064e422b722

SHA1
45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

SHA256
a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

SHA512
058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\results[5].htm
Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\search90PW80UD.htm
Filesize
161KB

MD5
ae4a474d26fd30808e1b7402958d4f6e

SHA1
e75752669b9607af8fbc6cf18af414f5698ae215

SHA256
a4c030500f2226a09c9d015014ee4bf9c94cba89ab51559c2cc11fff7e0be08d

SHA512
7d3ef4a91ee8d949c864ae5d5d3e2d3f9869ceb046a43a780977678c0f6c619e0cf3692ddb4d29d84690aa03b4458f2e4dfdeb6771e9e513db20a18a10ac2cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\searchLAY06H4S.htm
Filesize
143KB

MD5
073c36510dc7414b04203ffda4d18c09

SHA1
9184c21854f9fcf143cbdde2b19a01db4d9407f9

SHA256
77096770375373d9338297faa42d5d01a759bac92fde51222dc89893b50fad3a

SHA512
5f588a4a86cb5c0ce85c2f31715a574424f8e9018390a9eb517590d03311f8be0ae9ae3d3719604afe5f9f75479b72031f81550e680736510718db7219247016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\search[4].htm
Filesize
130KB

MD5
5cc257cbb3fd61572b9488de25fa406c

SHA1
10a4554fdae7c54503d2085b01aeb09dc38d6def

SHA256
070b4ba8d7c9f8fefbbf3103114c6ed66b00ee9337973566bf8286ed174e54a5

SHA512
d5dad149a6d9e3beeec06518e4fd4bf01e38d91b989f7adb442ad881370797f4e39672d851168631bbbd52104dba0a29dfa0332a920afcb28d81b059905b13ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4004.tmp
Filesize
42KB

MD5
3094980e765812e9e662f975fd4eb30c

SHA1
1db8ccd6b285976e71499217c5e5db844c52545d

SHA256
6ed58d1160fd1292125614eec5336e2d5794b57436db23142aebe56f60149ead

SHA512
de60d4920b7009b9e7676924410b871ba308d4e13b0e23ae0e9feb7a228d715e65691f5129e2db220435668e27a676a67358ce1ed88e0abb5d5b830f52d50afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
96B

MD5
cf439abff3cff17901c17271d116021c

SHA1
536d47523c6bf335bd595f66a6dc0d62893d42bb

SHA256
51847b52171e2eb4b143ea4c2917af992b84cfd7b3fd553478345427f83f3bd7

SHA512
ded48f88fc4109624fcdba1bc9e2571339c5f074116b19ee3568cf61fd812befbe79a5ddec8ff9336ea8ccf6d4caae1d2c89863871ed6529548b056b3f6c0ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
96B

MD5
db6dc5ce66c9bdc78187871c535d2eb5

SHA1
93a9939565f8415720497d80e819123a91fc4908

SHA256
8a99324d31f50ee66ea59facf99f6789c1afa8f13ea7a9ce6e822a57b56bc92d

SHA512
e6e4df57f1db34edae18a89233af6d36c28c273f61b1d40038e7c2e3d85f747ee8c7de431fecfca93885fc5ce601de5e18559aa24af37f17f35cf52815fe7157

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
96B

MD5
0a8e13bb38d41f4bfec9f3f2f508b180

SHA1
6af68f3b5037a884beaadf84c4a352c767cf14b5

SHA256
06b93565c16eab01d26fcec4590ba39794963a74b96b3dc6ecb48d2ae5a4daec

SHA512
33df54df05d4dce1a2a04ba97b73e83d164bd184f9b7f7f5c01b4b1fb4b3c65e7d03feba5cf2c505fd0c8c0a72e5245e33472625c459edb44559677bb1bf13d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
96B

MD5
849c5ded78f4754357890c4a754c174b

SHA1
b42fa3b7253e0b0b44239944bf5ce6c850a6ed8a

SHA256
bbd57e1423fcb4b644f79adcd2d0c25339cef862118066d67be9a1c8b2fec96f

SHA512
990dfa1cc07f88ff77d1bc0fa758e19a32d36e48cef8cd81ae41c6b728d9c2c18e7cf57d398a08ac1e5fcb88b20911687d2d1e5b74496c5038f17b1932fda1c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
96B

MD5
eb49270620dd28577840afdfe4baa263

SHA1
0554c0ef1b701a5b69dde67526db599670bf8fcc

SHA256
7de7ac04bb6c1b668b031605fe0da3279c7e45ddbae4cfdf73fa22138aeee159

SHA512
6e6cb064073606cbf4c23b2905d8dfd1f494c9a528bda58f50b2ea81005e9d09af7c38a1973ffd6b0b0450d2ab0f2eefc581175c2b5b13ff0b40f0b29ce491f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/752-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-251-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-248-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-309-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-164-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-252-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-483-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-503-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/752-506-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4632-0-0x0000000000500000-0x0000000000511000-memory.dmp

Filesize
68KB

Download