�c�[o��h˯�[����d�;�bs�G������bk�=w�ftv:q�qI�Y�ӂ6N��������HД�!�2Sκ_pظJ9��Q%��'��@H�qK�͔;��_4!���ul7h�x�U�r����{ɟ�f��0�h*��J�Z]g����l�>凗��i�1��>Ph��\&�ۧ����U�7Mj�����-��r�4N��/���!ֹ�'>.��Ph�.� C����Jf,e|�k�g*��l�i�dYD�D��i�Ƙ�c�e<Q������A�_D�2��{c$�D�+b�&t���L���ƺh"˳Ҍ�,�}:Γ�S�����F�`���v�S��S��}tc9e�����O@ғ)ΐ@wHPd��ç0���v��l��Qko��t�݆B똋��:|l����{:��(#���} M��?8�u��-�SR�������G�포���N��pbT[Is��C�Q@�F�1nI2�&.�)�%����=�$�����3G9d��Q�rG��,�tX�-�F�s����8H! O��'Q���@'2]�%��(^BA�1~���.Y��U_�.0�|���A|zn$o`��3b�Y��Td��YW2��~Jy��S��������.R��q�8�e�������`����(q�Py�h7�)G�S~��V��q���F�M��d���5�����,�y����m�ŗ���?�m��tʐ�/&��sT���T*���~��;R1Εʏ��j�Nk��n�+�R}��\}�7/�~��AG��i�#�E�����T��h^+�Ҽ���Ⱥ�(��Z��a� ���ll�L��Y���ZW%�e�:��05�j��t�}�L̿�UH��ݧ�zc:�ɤ ��0���;����I68���OL��X���4M��;4����"E-}7y��H��.��ӟob7h��6H����p�[�c#�u[Z�� I�p����֜���4�Жb����E%E:<�V]'���C�R$z���������AZ��$��c��ex���͒��<��ұЁ0]�~�� �����nC���Ε5��y3���ےi�8�#{��CbZ��-�~0�&N������ƒ���ʍ�J�p��tY�"��T�'���ߤ@�ݎՖe ��p=�H�G0��8��%@oh���(�#�uv�]c���YW3����jL_��$7���k벢l��В��G�����~�깢�*��G�9������M����̕���T!v~d*��A��eu)^i;�T@�O�(��{�����2�ʞ�t�b(�Q�KtZ�!%� �����&[mD�1��Gāk�]B�m�BQ��$= �b� U��H��Ġ�T tS�m2�b^.Ʊ�6s}^���nM4��A<�?)��W�`T/��XK�H=3��O!紶Z�1{��4Pm���"4�������na�K�}>���K�q�y�GiA�X�g|qJ�8�tے\�Q������UUHa�V�8錟א��/b,빳��?��ͯg���@�f��c�l4��JZ�0�r��,������YC��xu��7���G����[u��5����rDln7���M�B[!�����0,U�N/B�T�f�!�F��V���:�(�2~���?Z��<����tG��<N{���-����h�|�T�jGa�)����W�������`�~�55��b7����K�"V�S��F�XuGA� �{�S��Z�],�Y�Q1�P��^E_��Ԫ��O�-a��_�E�������Īђ��8��l�o����F��T9����5![!=�������,�<�}�I�A�k���UIӠ\�4U�9���A��y�]s�y�.bU����;�>�UU�n��<Un�s�iݕ���9�}�� w/c�i�6L06����K� c67#�����zɈ�w(|�-��v��A ���|�<�Nfj�8���$����|���ދ��I�y�K�j�V���X�&-�*w�znͺ،Z�7�i�P� X=�`���"��)�|��r� Ϡ ���Z���k4%SX2���/����};�9ʀ� '��i�[��c��Τ��]H�3��~Ğ�7�h�b��_ٴS�r�Fym�#V��Kl��\��3V ��5}��8e��b�9��i����g��Œ����*�[�3�<�G�i��7��$���������R ^v�3�NJQU��7�"�/�K��P��Z��#,���0Q�y��OdS��·R����p�����z"���!s����I̍2��:�5�hv�� ��Mbݎ� �7�7q0�� b�J�2�(�F����e�H�mD���� ����%|����tˏ�A� ��$T�>���CK>�h��=m�����,��??�:'���� ��DD�C3.��s��w�<��/�����y�Dz�0_����x����'�}(K�!����!'��i�]�㽴=�U�㰶�(��1螒��XW.�4�%V�2�a)����b�*0�҆�e���W]��ݛ�ݣ��s@]g,�|5�,HG@�_;O��F�Kc�Iz��t��y��Ƶ��&�[�������v��K��H�|F�^ٱ��}&�f�/�ʳ����z sM O��i.c;�J^ʏ]5��$���/����%J#���% 6��\䩯��额��ݎ�#� ���{�<�2�V��Z��'�����&�iļO0��5��~�1� �y�7L�~�p@�2;������Ԅ��w��g;1o-1O�kfb�qKC81�aUo��Œ�������ɵ�]}���r��(�wIU�%t�GB���j�9�q�g����}��P�hy���2����������ч�K㤐���Ӷ3�S��!U�(+�+�h�_���3z�ޝ�r���L����z5ɡR��i$Ix%�#�CjG�����9Y+��a�3KljBD��^���BD|��|�.hjm�l��]��<�ݏ}�BеZdk�ٿ@�m iH�VJ���_Tr��O��N�����I�h��=��Pe�6Q���D"'�qO�ֻ&t�[Vm�|/�Ͻ6��-0>ug^��Y%��
Static task
static1
Behavioral task
behavioral1
Sample
defb2b6fa7b2a269281b77a416a408e0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
defb2b6fa7b2a269281b77a416a408e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
defb2b6fa7b2a269281b77a416a408e0_NeikiAnalytics
-
Size
5.5MB
-
MD5
defb2b6fa7b2a269281b77a416a408e0
-
SHA1
1bcb932b97c5094ad50d5f4ed5610979049270e4
-
SHA256
6dfcc860d01b02d7d52d1b7e3fb49db0ceb8fa814c003567c808307c00ea6002
-
SHA512
fcdafab35c092adb150eb9bcd82857a0f3118c1f5bcb3b21398ce4c90bdf60704ba7d8942a5556cee414a126237492620ed34eab8f3c3e152c9f65c9f9843e73
-
SSDEEP
98304:U23H9Dme2OBdH+tim/LF7ZNckFEN4CAEU7onQN5I:U239DtdHUcSoAI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource defb2b6fa7b2a269281b77a416a408e0_NeikiAnalytics
Files
-
defb2b6fa7b2a269281b77a416a408e0_NeikiAnalytics.exe windows:6 windows x64 arch:x64
f866b21c835ec67a7905af8ad21cf598
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
isdigit
api-ms-win-crt-stdio-l1-1-0
ungetwc
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
floorf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ddcw@X'M Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Ddcw@X'M Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ