Static task
static1
Behavioral task
behavioral1
Sample
3deb69e464584adef0e765eb1fb26100_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3deb69e464584adef0e765eb1fb26100_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
3deb69e464584adef0e765eb1fb26100_NeikiAnalytics.exe
-
Size
372KB
-
MD5
3deb69e464584adef0e765eb1fb26100
-
SHA1
5f0a74f488f21292d4f79f690c637de00ff619bd
-
SHA256
3b41079352a2b4a647db9219d0baa1c6efb38e62e57792f984f665f60ec1d813
-
SHA512
53e22b85647b78e6630b0ad8c16062de42455201a86a2154fb4542f164d4e022ccf5992b9ad9258719ad2f11c32477e04a532b36ca0c61139c662d3c35b1da38
-
SSDEEP
6144:OU0EcOO3aXyiatr4k3XIP7E1+8e3rJzg4SIggX0pDUJM4rkTH2Va/5A2+jZpr38h:OFE4syiatrdwGe3rJzg4SIggX0pDUJ9y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3deb69e464584adef0e765eb1fb26100_NeikiAnalytics.exe
Files
-
3deb69e464584adef0e765eb1fb26100_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
027b287a7774b7071d2745601fdfd1e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
DeleteCriticalSection
CreateThread
InitializeCriticalSection
CreateEventA
SetEvent
CreateDirectoryA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileTime
TerminateProcess
OpenProcess
GetCurrentProcessId
Process32Next
Process32First
CreateProcessA
GetVolumeInformationA
GetSystemDirectoryA
lstrcmpiA
GetSystemDefaultLCID
FreeLibrary
OpenEventA
ResetEvent
ReleaseMutex
WaitForMultipleObjects
LocalFree
LocalAlloc
CreateMutexA
OpenMutexA
OpenFileMappingA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetTickCount
GlobalMemoryStatus
OutputDebugStringA
GetTempPathA
CopyFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
QueryDosDeviceA
WriteFile
ReadFile
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
lstrcpyA
lstrcatA
lstrlenA
GetCurrentThreadId
SetUnhandledExceptionFilter
WideCharToMultiByte
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
MoveFileA
GetLogicalDriveStringsA
GetSystemInfo
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
Module32Next
TerminateThread
SetLocalTime
SystemTimeToFileTime
IsBadReadPtr
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
DeleteFileA
SetFileAttributesA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetLogicalDrives
GetDriveTypeA
VirtualAlloc
VirtualFree
GetLocalTime
Sleep
CreateToolhelp32Snapshot
Module32First
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetVersionExA
CreateFileA
DeviceIoControl
CloseHandle
GetPrivateProfileStringA
GetLastError
EnterCriticalSection
LeaveCriticalSection
WritePrivateProfileStringA
LoadLibraryA
GetProcAddress
GetPrivateProfileIntA
GetCurrentProcess
SetConsoleCtrlHandler
GetOEMCP
GetACP
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentThread
SetLastError
TlsFree
TlsAlloc
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
FatalAppExitA
LCMapStringW
LCMapStringA
MultiByteToWideChar
HeapSize
HeapReAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement
HeapFree
HeapAlloc
GetFileAttributesA
GetTimeZoneInformation
GetSystemTime
TlsSetValue
TlsGetValue
ExitThread
GetStartupInfoA
GetCommandLineA
ExitProcess
RaiseException
user32
wsprintfA
MessageBoxA
GetMessageA
DispatchMessageA
PeekMessageA
advapi32
SetEntriesInAclA
SetServiceStatus
RegDeleteKeyA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
ControlService
CreateProcessAsUserA
GetSecurityDescriptorSacl
SetNamedSecurityInfoA
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceCtrlDispatcherA
RegOpenKeyA
RegEnumKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetUserNameA
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
netapi32
NetGetJoinInformation
NetApiBufferFree
Netbios
ws2_32
setsockopt
htons
htonl
bind
select
socket
ioctlsocket
recvfrom
sendto
inet_ntoa
ntohs
ntohl
closesocket
gethostname
gethostbyname
inet_addr
recv
WSACleanup
WSAStartup
WSAGetLastError
send
connect
shutdown
__WSAFDIsSet
udiskgui
UDisk_CheckPwd
setupapi
CM_Get_Parent
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Sections
.text Size: 280KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE