��ޛ�f�~���R�=��e67>��������v.RK�HF���#��n�(,�W�(��Ǽ^���ce:���_�gf�u��ƓA���)��A��{��$��ۗ�y�����w^!y��5���ʤ���1/���~���p��I[����i*�����ٱ��⽽�h�3TH�S�Z�e�(0��^5h*���B��#|�ӳ֥A�6��`�=N@Я�@�����ϷX�g�Vٜf�{��(P:F.E3���o���T��Xj�S -@�ӹH�|�~`���������Mk0�T?p����E�#��{8�x9zĥ4`߀��)�<�բ ��w��z!�9�Dɧ �'MIȋ���+/��*V��YZE��7-����f������F���*$U�Fr�5B��vʈ��g��c��=�F���İ!Dsg�-)C�\�f�l4��ȻbW˄Q�0���_��>��D��?�1Q�|dkơMZl�S�[7f�bZE��_�N��_�6&�;���K2{;&�By�z�!���ⷢ�'��k��X=8����n�瓂��ެ��� ���� C~�\�G��:Ӂv��rU��������� -W��Qb~�P�G��j�g�A�]�����9��M��ئ_�� w^��`��p�H���s��a�4H+��o+�1(�5D�j�,��w8<����u2������ѧm ��LEP�jr?,+��zv���0ҵ�^��n�sJy���:�X5�ʓ�a���֘�#�͐�������/�9 �\!*�%���e�mB2zn N����K߳6�ԧ�����˸���n&"���#��CV�S�^ ���0Wf�@�Lm8��[1�O�����͊[��v��3G�h�%)4�h��uZ��9,�G����6��L#*RBW�n��?.o�86sfH�}*Tl#u<���%�6G� �Ia��0����b,4�곗��;�$�T��<ѩ� �L��<����Ȼ�o�ZI8�kG����8��%}�a������ljY,��<.��ʄ�N��n��,���Z��bFOG��mb�>���(�7��\�i4��Hf4�쫿f�و-ME�{��$�}U ���4hDq*59�,���{@�(M�ea�t}�3��:��s�wZ��+�: �x��}���G�W���@���������9�5Rr��G<��w=�k��i�]��ʀl���i��:�aV���9w�r6��f/�4r����J��E��5���m�ԑXo�~;/<mȺ��?�q|VϽSe�lìco�r2���:�BJ+��*�yeG�ߜ^Jc���a"����"�P?;WJp�12��g';.)�i���zv$�L��,I��_�Ffi0�!H���/9������b���Ce>Ͻ\�9�~�I���:R�;������m��2� H�B�V��ۖ�\���?$���y��C��L=p�����/��S��k"�k�ь�Y��`���؈��-�'���j��c%�EF���!��U���Ep�[�A=������ ��f���M�Rԝu��u�Ym��w����TV��������@��[�hRt�E#8C��}E�B�3fu,|��ȳ��%��HݻamU� OBZ71d3V���g$y Nw�%��8��2C�^/� ��������&��%��E̟KS$����A�Q�~gA�5���L��n���� ���,q��po���d Xe�S��&���y) �������X5-�OH@?��t[�>e���8C��W����G&�Y>��� �~hi�cʐ�`��J�Wg��A1����ň��̜x���_��eU���8/�HMɰ���-�\�����8Teb{�(�yIC'�3�XU*]�T�~jhv~]�x�T�q�#"����E�O-����N�8�����p�l2E�];E8��L�f�>���hIB�pwy��a���!.��1k��|���7�`�5����-d ղrfQ�6@��gvs�/��p�2�g�Jx�%�U�����b^=�� X�����%���.�m�����U�`:5� fj3���^h�����yu�����3�5<)!��6C=q=D�6ћ1w�:������#�֒VqU�7�X���x���)�ؠI�A��R���X���~>��Ԡ��F������TQ��Z}[��p�R������=Ճ˒w�\�^���L1&a��1-�w��I�E��v�)(��0���t�/���o�˃B>~����`������fc%_4y��vO-C+��&z�W1Ng<z�'#�5MH�A�j|�> �FX�p'։JlϮ�"�A|X�D�`.��3�\��""ژ7ڢ�?/tR*"�wC7�d�w�O;v��'��}����i(e��#��9Γ �E�^s�D9�8�{ێB6�5 b�n�e�7zGB���?��X{0�P� �V�Ӿx�$�u�f�%�)��;�0e�ec4>?�rv��{@��o�v���[��l�X���ܲa3�n�m�G㟏���� �>oq}�p�:;�Q�Y="�Z�D|�I��d&����f'��݇M�C�\Ԧ���I����_$�x����~�UVrl�$G��]A���lj��ӃѬ��ԛ���H,QQ+�f�� ����&D�{n�\h���%;!���VaM� �/�; Ũpݱ�r���ų0��9���=E�/���N�eU��ߝ �&��w�}�G��8��þ��ؠ�-L��@<Ƒ��[A!�@����1��Ý�*FY����4#19��c�O�M�[�I�>����A����������/DD�w�A�F�ܸ�6T���4, T�EY ����D�/&��a�"���`W�'�H��ׯg���$�}�/�ӐM^58����4�k�P"fU@�;e��M��;N!K���y'�J8ݱ~�m_k�|~ةX_�(��OUk# B�JQ��3R�*}����r����� ����������X��)��89G����Q,����h��O�$l,���ݭ�©�s|#�����P�, Hܴ�>�H����� %\��$aՠ�dy��s#��1\ [�u�`��8Sz�D^kT��p�h�j��
Behavioral task
behavioral1
Sample
797a8957f0aac9d52c7916662064a1e0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
797a8957f0aac9d52c7916662064a1e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
797a8957f0aac9d52c7916662064a1e0_NeikiAnalytics
-
Size
6.7MB
-
MD5
797a8957f0aac9d52c7916662064a1e0
-
SHA1
039cd20bcebf9e525acbae1e0ec887b499c75ace
-
SHA256
7d5d24fe19e1c9f8d87f95a980776fba2cafda2834271b6bfcba840c4835fa3d
-
SHA512
0785ec959365e41a58710e4360cb3047c540bbe8d2c9dd732c027c498ac8b8d70b8f0dc670fb0c94ff348dd824ac6857e796355d5cd703190794ae4237a75ab0
-
SSDEEP
196608:fG6a8nbXDl5fodCWFQjk1GF0UbMp3ctyv53Ck:JtbXDjfsCWCjLFBbMp3DR3C
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 797a8957f0aac9d52c7916662064a1e0_NeikiAnalytics
Files
-
797a8957f0aac9d52c7916662064a1e0_NeikiAnalytics.exe windows:6 windows x64 arch:x64
9a7163ac310547a6da381e2ad0e6f9bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
OpenSCManagerW
shell32
ShellExecuteA
msvcp140
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
shlwapi
SHDeleteKeyA
ws2_32
ioctlsocket
imm32
ImmGetContext
ntdll
NtQuerySystemInformation
crypt32
CertCloseStore
d3d9
Direct3DCreate9
wtsapi32
WTSFreeMemory
WTSSendMessageW
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 732KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ