��?7��ys�"�����2f3�����r��&�+����B �BO$��0��<6�"I�~PX���q��4�gj���v��ڿ��)��b�I3���6���{e�*/���������^C��ɡK���E15Ӹ��\G��nL�h�i6�*�toE��e�A�mZ�lY�����*�[�.o��3U��� �ؕ:��3+�b�T��)t��+og��K�*���4p�G?��SذU��ڳ0�E �����gT���2<Fd�}�N�־�8���cM �{��f�Ś�6Ԕ�.���Yj�⚷�FE��ѯ�)N�㬊�ր�z��U�apt���ۦU,��`̜֡����A �S�+!���%��j�Cӫ��$�,:�|A�;`s��@ޜ���R���������@8U��YR 5ǵQ�p_|���]�l���Da�����o5�Y�=&���UL�6�X�׃K�&��s��љvB����Z��ṃ�]q�>��C�f��ޖ��+� �@�����"�pN��Dwń���������R1!�s�q�X̃~n��$�����bO�C�� ��ԍ��*�ĥ�/�:��M�P���C-�o$�ov �Kڅ���\�%`��w5�.�c�#���_��L�U��_��_A[�M�lw ���b���2l�ebp��N"���IZX�������K�s�:G ;�˅��Jy��� �bej���%n)���;��>|�-M̲�����,Ǥ:��ԝ��DD`x��2����Y��o��9������q�cS�k��`�@�Q����x�����>�ǭDq|�hd��sv�]�j+7����p7#���\�^q�|�`>m3��"5y��x&� B��9�����L�� j��߯tw�IC�B�|y�`vV�GY��ziIr`>P��`9zy�#g[vN^e��Gsڧ�T+A�\������m$�o����i @z����E�����|�2B�?QݱJ�)�k�B�"��}���u^��V���^ �Ue�+l����4�l"Ґ���f��� ���m����`��[�2�a?���a���+"����d;Yc���[m��6��s�0#s/��:�1'5�㓿/ʦ}����.�4w<� �Rp�/!H+����[�+�SK����3<Z�u�է_��j���aTTޖ�Ar�g�� -����D<='��I56�Ŏ8�N��>���h~��4ӗ��-��D��0�Fl���T�cz^�j��=^f����W��@�<{� ���\)�ZV�K��]�W"h����,�Zq������W�U#Z����Y��V��S���{� o����B%)]�p�x7�����~u���)Q�)O�^J�զQXN���Je0p���>',��BsO`B���A�jr���9�4S�:]Q){�^��+��\�Y�L~O ���.j��@K�d�T�u����n����5N]k[ �<k�Tʽu�%@�R�O�}I������C�'o����h������ �q�o��-����8��!�υ��p�Ψ�r��D;���%������c�.6�j;�������G�$��Y'��tG��4����Z��CJ�j�e��i��.��zش�!Ř�ꈐVI߮5����.�ay�F�N'~�A�җr�����E{ 8O��Q�Hй"�8E�T����<,��:$�l>�+@W���W��+�P!㒪 �Wۗ�zg^��Z[b�""48~����YZ;p7��8;��7��>��]Cm��% �Jɠq6^~$�tQa��k׆�G��i�.���6���� B=�eÀ�lj�ME���4_��b��/G��T5�q c Ȣx�7����3��}y���}��)9EI۶��0Ax�7��?{�w`��&�=�?q���=j�icl[�{��B�υ���Ok0��w�\��flBeG���?'�*���uW�:�!o rj�V��;/~�A)f.�������[ʍ=���E���94�+ ��^N[��������*�m�S� Q�yy\�u���GX]�����/r�����[�纺���U�� �{aC��{넛��o���_J�Jd��?��S!a ������]�ASX0y����]�\��ٸ��{� A�t�j �0^F�j%�Bp�18b�P�������p� ��f������ u�(�Нn���ܟ=�œ�F��N�>����B��ѱ�*̩��:q��r�?�V$��+T=��tI����0�>C\�?��gB,�-.L�T�.�ȣ���v� \�1'T��F0p�R؇6���\�H���"@�.ğK��_@�:V�ڰ{w�ܹ�T|���Z�2 |���ͩ@ur7"�=��0��:�lKw��f \ 5��j���q�b�� �O���4�4�;ݤW8JLL�� 'I�Ӊ�wbE��ҕz>ޭ��I��s���~|��� �X��������P�#a�8�Km��c_�mZ\�4"/�x!�_��~Ox�*HB���j�n��<��~p�30sz5��b<�Ծ��*$��}��0��JT�o��In+V*�aYg�ʚ4�AhԜ@�j[2fO����Kkv�۳T7�gnS�ʂ���� l����% �0��j:��9bwpmO!�Q:�F(�3�'��df�@%f<bYYO���yt;Sص���C��p���/�'�XͶX��<@�̣�|��6P��<]���RTJO��dg����w���r���LÁ��7��4�Z�q>e��a}��b{�K��Ukl���r�\�g�}��u��� �]�&�#�6���3��kIݕN�]�d�"M��=t�r�� ִ36H��a�yJF��V8!��ӵjV��F#�?@�v��N��ZZ�Ok���ĥD��ڙ����/O��V�ɏ�!��8��Z��f�����_;�sA�����GSw�%��0h'F�n� �E�W�G���/%Q�_��� Mp��+`B�aBL?�d.ЇV�8cD�M^hQ�6��LoGo�[�����~R��U��I�� q���A��j�c�Q,D ��8��ߍtet�s�-���]����wjI�m?g8C��^�
Behavioral task
behavioral1
Sample
96e6206be603549c7680a9bae8227f40_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
96e6206be603549c7680a9bae8227f40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
96e6206be603549c7680a9bae8227f40_NeikiAnalytics
-
Size
6.5MB
-
MD5
96e6206be603549c7680a9bae8227f40
-
SHA1
447bcbdda0f6d06eec334af5a80d9ff1a1b1ef39
-
SHA256
ad8ba7edd6c0be50473b7a6e89fb0daf46048f0dab46fb3b03eb8759f7b8c35a
-
SHA512
ccae20af7d1f3eedd62b1f9a54786f53565b77cdc72711ecbb16efa04e14e463e2497ce55b67f9438113117fd27a34dc6b1d1c04bf6229bc0923416089a646d4
-
SSDEEP
98304:wpSjsjdhTAFo8ELFNPFt3yr8OWosUWidR8+NAn+jspKTXC6SIriAs6q7k:8SgjfEFoTNPFt3zOWodv24GmrZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96e6206be603549c7680a9bae8227f40_NeikiAnalytics
Files
-
96e6206be603549c7680a9bae8227f40_NeikiAnalytics.exe windows:6 windows x64 arch:x64
d527597a0c945674dcc7e9a523e54252
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
RegQueryValueExW
shell32
SHGetFolderPathA
ole32
CoInitializeSecurity
oleaut32
VariantClear
msvcp140
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlCaptureContext
imm32
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ