d489c206da7a2e142d9ca5f185c7db32e3fd1a856276485542f7a77a1f56be61

Analysis

max time kernel
140s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
Size

73KB
MD5

4e27425149fe7c09b65c9859ca1dadd0
SHA1

e272fee3e02aac83402ad1e72093a225625a0418
SHA256

d489c206da7a2e142d9ca5f185c7db32e3fd1a856276485542f7a77a1f56be61
SHA512

52f9f1c56bf311a67000d38dc24105073628897bc55eb691c0b596eb1046771a5dbf6ce83c16dc9d2d8b0ea7d817e3456a619eaf70534b3d19737f50b0cbb8ea
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSRjqEE0:5JjcF8KfCOcjk+guPVjSRhE0

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023426-6.dat	upx
behavioral2/memory/432-3-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/432-35-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\AOL.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\cute honie spreading flawless ass and juicy twat.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\sister and brother gettin' freaky .mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\hot slut with a big dildo.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\babe with dick stuck between her ass cheeks.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\fine babe spreading extremely hot ass and furball.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\maid's vagina plowed by big cock.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\two hot college girl fucking in class.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\old lady in bra and corset with dildo.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\older blonde showing she has the goods.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\two sexy blondes share a cock.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\two kinky old lezbos snapping the whip.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\cute teen with her hole spread wide open.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\nasty teen posing in panties.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\MSN.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\brunette fucking in bedroom with boyfriend.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson sex scene huge dick blowjob.scr	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\hot anal sex for the first time ever.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\anastasia nude.exe	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\babes getting their tender little asses corked.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\swimmingpool threesome fuck suck group sucking.mpg.pif	4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4e27425149fe7c09b65c9859ca1dadd0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif

Filesize
96KB

MD5
598360f67bc724da793b147ef523b98e

SHA1
2d37b7f131511f48836fb6dd1d7acb6da8289e2e

SHA256
e5f587d66144be5ebeaad1576afdab0c7e7687eba54e557140587be0a97ee564

SHA512
b8d13d721a9e5612a6a8eec525d7efde0148ebc8cdd1e1b0d5b4ea79a041682a884b49444ac5f2cc1bd93389a12da8e96c468e5ffb96d0a54a8c2b42ae672561

Download Submit
memory/432-3-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/432-35-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads