/�Z���x7����=��f'i�X���F��\�����v� Ro�|�ڎP"���j�e���q��-讕)r!oI$�<���)��~��i>�/���}�|Q�N�ʦ��P��8�6�DQ{01��ޙJ?KQ�*���NT���jejQ�Sn����X�/�w��Ln�z[����ms{9�>{��*�My�}�z�,":���u�<UG��N�x<\���4��=!�l��+��^�L�ϚL�K����s�"���]�����\' �8�N��= iy��,f"��;K�=f9K�ڀŮ�y��2�$w[�ۖ����c��Q�::���/5��/�,�� ��+�������4-f�d��Ͽ���=���ϱ;��{���_){�-��RӒ�/�!��t0������V��O�j�H?Z=��6��n��pȽ��*�>�<=����M�m�O�J�*�N�w �dU�s��U�y⇍|Y�q�CZ<�j,�B!�m�����d�8+� mI��F�zW�n��a1a���G����#�a2粹1�5Ʉr�,��Qϧ����yЌx�\�ns��������D�����0zU��!ѕ��Lz���#�v5k�9������i��Y�;�[��VC��&旟�um���h`��>�r/ӁjM&I }�� uN0���.$�'�vn,H�q��R%�PY=�׃��6�I�"�bQ߀S�����Q���/��(쎏�-�e�zԶxh���s�[[�iJ�o ϐ�:��*8�w%�s�ҙL+�KY<���F�x���w�����N���gi1�T0��9�6�IA��������#�ݡ|l����;u$%T�n�~b:_W��c=�Ri��~~ݚ���QA���xe��ճO�~F 2w��%���g2%���w���)ȶG�9s�Ի�@8L�EMs?���Q���}�,2Y)�nh6v��(U�p4�� ��K||������� 1*�\�@s螫�����x?�%BʅB>�u�����d��4�н����������x����ƍ�m��pn�a��Cg� M�JjV�����s����dK��|o]����O�����U;?� �}X��G~\w��d�2zCVЂ�Ny��aEm{x�n����x����;B�^��� y�����(W0�Q8O%3 /{��EX��C����l�g�j� �Ve��)Q{pbPi<V=�iq��tv��� �`�gt;܇0s�� &<�l`���=�w7����+�^��&'I~��K���9��N�n;�/+��Ϗ�8xKQ�_�yC%W�=1�$e�6�/5�x��՜�U�a�j����d���k���[Z��B�bV�����^x���|�LFжb �p�LPM��Ŭ��=�M��'��g5s�����F�LpJ������ԣ�:"ȣ��[��i�(s�{]�l�gY����H�\5Qh�a�Y��j�YU����J�p4�*� ��)�I��b��lz ��SgS��):�n ���'���RxsŘ7(}���л{�c���/�cTJg�9Y�Y�k~���� �;�a#��&I]p=%��Fg�if�����WD�RJÒ�լ�/�3c��*E߀\��}䜚�2�]Ț�u�fQUSpyʴ��ٸ��x]���>�x,~�q�)�s�)��j���%%�3�?���H��Rz�)��*���_�����Ҭ �ɓr�����qc��7?�V�J��Ċ �����f+~}82��vΈ����^����ɦ5LM��!�����J��L�1�U=��q5�q���B�����]�#u|Ղ���|r������5��:�txsor��S:�z�4!��^��M�Վ�,�:0ց���I; �6hд%[?��-�5���[g���r.�P/T��L�*���/��Jϸ��X����0�+}��r?��'��y���xz�V���^h��ڽ�h�xpB*��f{��ñ?�i�S����lF��ZP�ʀq۸�s�l߽ECdٰ��&9R���:@�{ن �tϳ�����{tK{ ���V�sa�w�{�]&��� @������ s�Ҕ샼9�t���� P�)s8���UÉ�����lܮۋ�uI�GT�(50W^��ӎ����AG%Z*�n���WI�[����gk>��Ӱ�+�n�/N>N�Vxo�HN旔��L����(�a��:DX�{L�ed5��}l��%%�E\���#Z% �5|�F�d�) g*ӽVc��b�2-�<E�M���M_��t�?�����ro�Y?ϴinBiak*�*����Zv���v��A��OV�{��@�6��SЁc�6����Ul���{��c�A쇰 � c�ʼn>����?;��Q���M@��^P.��z�Ӽ[�`�B6o^��;ئR(�si,�DKM-��-M���=��ɵ��;�#;2��2?B���C??���O��x��x�_Q�V8~Zmy&��yf�TJ��=�ݷpP�t^/����b�=��͋�t9������(��b�M�vA�b��;["v,���e�:���ߏ�x�F1��a�p'�>��� u����eL�0�Z;��~&�s2�) ���u�L ���7�D��D-���7�y����V%F{u�b9UB�����j�O�]�pp.��u����HMm|\W�����������Np���]���gD�ʽ��ؗ?b�BɣIh����j�)�,��0���nka�j�z#\ߦ|)�O[1X�j�1`���Q_�J>��L��X>���&m��6�!�լE:,St���קO�dx�[�����`�pG��#�Xg{��b��|2��m��J�>�y "̜�i����x���l5�[+�饢ش\����ґʖ��,�VPU���"�<���5�+�U^R.���u�쭇~�4�h���K�����g�7��r��k�nӹ�x9eI}��m�O�dP+����Bߘ�?1ax�E�(���������8Hݍ> qk�yf�r��;���{�.�~�I殊��sA�^�m�du���(1�b�|#�8PT�}>k/y��@Bw$�Ɋ�Y���\����^TQ �a��P���*��R��L
Behavioral task
behavioral1
Sample
23d641b45db07e221f81a74a2e1f8340_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
23d641b45db07e221f81a74a2e1f8340_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
23d641b45db07e221f81a74a2e1f8340_NeikiAnalytics
-
Size
5.0MB
-
MD5
23d641b45db07e221f81a74a2e1f8340
-
SHA1
fe2f89a1a14554aea2615eb41c73736c506251b8
-
SHA256
e6998be23d43915754d491c1654ba9d656c05758405e980ecf07867302f4af81
-
SHA512
5ae2d56d1da324f5f29b52e8c120eeba44fe30b840c6bc4578e629e9b9bfe3d237dc42633602d3ed39a14e23abb1aa6cedb63d0f12a2fcce33de61e448b59ba1
-
SSDEEP
98304:mLkeHOSTZKqwpC6jwYQw9vs12PWmO66NXLyYISNamXvgPrxPxRPA7WY:vedJ/dYQwFs0O6qeYrMj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23d641b45db07e221f81a74a2e1f8340_NeikiAnalytics
Files
-
23d641b45db07e221f81a74a2e1f8340_NeikiAnalytics.exe windows:6 windows x64 arch:x64
dcf99541d83c0cba3db0d289b95fc94e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVolumeInformationW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
ws2_32
__WSAFDIsSet
bcrypt
BCryptOpenAlgorithmProvider
vcruntime140_1
__CxxFrameHandler4
vcruntime140
wcsstr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-utility-l1-1-0
_byteswap_ulong
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 340KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ