8312569300df4361fcb438bd8ea14c8c7e3e4f0bff12fecf693a5890b8e2f95a

Analysis

max time kernel
70s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe
Size

130KB
MD5

55c5c0f23c09a79a09e2b260c96d91f0
SHA1

a5c6d28e8879eabc337a9c642455f409310b8f92
SHA256

8312569300df4361fcb438bd8ea14c8c7e3e4f0bff12fecf693a5890b8e2f95a
SHA512

1b3d26b34a7bba02c5f0a85dfe50170ee53c9699dbb54d18ba3ec73125b067a4d184a8307db135bedeb16fb808a97693729b0015e0b287cbaaf2fb3dbf9f8ec0
SSDEEP

1536:mH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmNJ:6KQJcinxphkG5Q6GdpIOkJHhKRyOXK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1692-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1692-192-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1692-798798-0x0000000000400000-0x0000000000423000-memory.dmp	upx
\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe	upx
behavioral1/memory/279880-798845-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe

pid process

1692 55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe

pid	process
1692	55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Users\Admin\AppData\Local\Temp\55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55c5c0f23c09a79a09e2b260c96d91f0_NeikiAnalytics.exe"
2⤵
PID:77020

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\EWVRT.bat" "
3⤵
PID:279760

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
4⤵
PID:279816

C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
3⤵
PID:279880

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EWVRT.bat
Filesize
145B

MD5
da0cbe87b720a79b294147ed6a4b98be

SHA1
ebf0dc9efd7a12cb192e355cda87546acb4ab360

SHA256
7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

SHA512
f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

Download Submit
\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
Filesize
130KB

MD5
3ed152f03124cbcc17a2454273ed35cd

SHA1
973f0e992f358b345df16fec566b6e2775c471f1

SHA256
b2dc179b2264828bfa77c6484def5548146670065672576a9a2f9b20f3c18179

SHA512
dd5adab1307fbe2cd7df876d9bbd06f155377cce621638e6663674b504b81be62eba4d85143b6146b686b972f23ebbe597afe36f4584717caf263f6dc6cd6a34

Download Submit
memory/1692-192-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1692-798798-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1692-53-0x0000000000416000-0x0000000000417000-memory.dmp

Filesize
4KB

Download
memory/1692-51-0x0000000001C80000-0x0000000001C81000-memory.dmp

Filesize
4KB

Download
memory/1692-41-0x0000000001C40000-0x0000000001C41000-memory.dmp

Filesize
4KB

Download
memory/1692-21-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download
memory/1692-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1692-3-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1692-11-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1692-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/77020-798843-0x00000000024A0000-0x00000000024C3000-memory.dmp

Filesize
140KB

Download
memory/77020-798842-0x00000000024A0000-0x00000000024C3000-memory.dmp

Filesize
140KB

Download
memory/77020-798841-0x00000000024A0000-0x00000000024C3000-memory.dmp

Filesize
140KB

Download
memory/77020-798840-0x0000000000480000-0x00000000004A3000-memory.dmp

Filesize
140KB

Download
memory/77020-798839-0x0000000000480000-0x00000000004A3000-memory.dmp

Filesize
140KB

Download
memory/279880-798845-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads