Static task
static1
Behavioral task
behavioral1
Sample
96bdb027ede9af2ed96230f5e2a3a370_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
96bdb027ede9af2ed96230f5e2a3a370_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
96bdb027ede9af2ed96230f5e2a3a370_NeikiAnalytics.exe
-
Size
3.0MB
-
MD5
96bdb027ede9af2ed96230f5e2a3a370
-
SHA1
c912f0578e140dd0bafc4718e2501dec52303290
-
SHA256
de2816d47dcda54ff117acc65ae87dbd748a3f5a420090d9357f0342f3f642a5
-
SHA512
efa90272ee5c60eb6ccb38644d548b114a9b1bf609aca33df61b1fd8d2f1a13a1f9d48bd397d7c353325147df6783d079d17aa0f7dfeb69261203f0f139d03d8
-
SSDEEP
49152:HATBXCkr/qSdEsp5r4vLNmLTA+L/5e8RoJ5DjQUTpZw6Sk/BLcF:H8gSdEsvXLTDzs8i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96bdb027ede9af2ed96230f5e2a3a370_NeikiAnalytics.exe
Files
-
96bdb027ede9af2ed96230f5e2a3a370_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
88f1478d9dd8fb7315871cf07e051f96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
CreateToolhelp32Snapshot
GetCurrentProcessId
Module32First
CloseHandle
Module32Next
GetCurrentProcess
ReadProcessMemory
GetLastError
GetSystemInfo
lstrcmpiA
lstrcmpA
VirtualQueryEx
VirtualProtect
InterlockedExchange
GetWindowsDirectoryA
FormatMessageA
LocalAlloc
lstrcpyA
lstrcatA
LocalFree
lstrcpynA
GetLocalTime
IsBadReadPtr
QueryPerformanceFrequency
SetEndOfFile
Sleep
CreateProcessA
GetExitCodeProcess
OutputDebugStringW
WriteConsoleW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
FlushFileBuffers
GetModuleFileNameW
GetOEMCP
GetACP
IsValidCodePage
GetStdHandle
GetCurrentDirectoryW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
FileTimeToSystemTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
FileTimeToLocalFileTime
SetEvent
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateEventA
SetFileAttributesA
CreateDirectoryW
VirtualQuery
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GlobalFree
GetModuleFileNameA
ReleaseMutex
CreateMutexA
DeleteFileA
GetPrivateProfileStringA
lstrlenA
MoveFileA
FindClose
FindNextFileA
SetEnvironmentVariableA
FindFirstFileA
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCPInfo
LoadLibraryExW
GetDriveTypeW
RtlUnwind
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
IsDebuggerPresent
DecodePointer
EncodePointer
GetStringTypeW
CreateFileW
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
lstrlenW
GlobalUnlock
GlobalLock
GetProcAddress
FreeLibrary
GetVersionExA
SetFilePointer
ReadFile
WriteFile
OutputDebugStringA
GetModuleHandleA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateDirectoryA
GlobalAlloc
MultiByteToWideChar
GetCurrentThreadId
ReadConsoleW
GetCurrentDirectoryA
GetFullPathNameW
user32
DefWindowProcA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
LoadStringA
GetSystemMetrics
GetCapture
ShowWindow
ChangeDisplaySettingsA
ReleaseCapture
SetCapture
SetCursorPos
SetCursor
ShowCursor
DestroyCursor
LoadImageA
GetKeyState
SystemParametersInfoA
SetWindowPos
LoadIconA
FindWindowA
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
InvalidateRect
MessageBoxA
CharUpperBuffA
wsprintfA
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
CharPrevExA
SetWindowTextA
GetMenu
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
wvsprintfA
UnregisterClassA
CreateWindowExA
RegisterClassExA
gdi32
TextOutW
CreateCompatibleDC
StretchBlt
TextOutA
CreateDIBSection
SetBkMode
DeleteDC
DeleteObject
CreateSolidBrush
GetTextExtentPoint32A
SetTextColor
GetStockObject
EnumFontFamiliesExA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
ole32
CoInitializeEx
OleUninitialize
OleInitialize
CoGetClassObject
OleSetContainedObject
CoCreateInstance
CoInitialize
CoUninitialize
winmm
timeBeginPeriod
timeGetDevCaps
timeEndPeriod
timeGetTime
d3d8
Direct3DCreate8
python27
PyImport_ImportModule
Py_BuildValue
PyExc_RuntimeError
PyTuple_GetItem
PyInt_AsLong
PyList_New
PyString_FromString
PyList_Append
Py_InitModule4
PyModule_AddIntConstant
PyArg_ParseTuple
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyTuple_New
PyTuple_SetItem
PyInt_FromLong
PyDict_Size
PyDict_Next
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_SetString
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
devil
ilOriginFunc
ilBindImage
ilEnable
ilLoad
ilGetInteger
ilConvertImage
ilCopyPixels
ilDeleteImages
ilShutDown
ilSave
ilTexImage
ilSetPixels
ilInit
ilGenImages
imm32
ImmNotifyIME
ImmGetIMEFileNameA
ImmIsIME
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmGetOpenStatus
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
imagehlp
StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary
granny2
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyGetFileInfo@4
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyGetMeshVertexCount@4
_GrannyMeshIsRigid@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyFreeControl@4
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyDeformVertices@24
GrannyPNT332VertexType
_GrannyGetMeshIndexCount@4
_GrannyGetTotalTypeSize@4
mss32
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_enumerate_3D_providers@12
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_release_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_open_digital_driver@16
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_auto_update_3D_position@8
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_mem_free_lock@4
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_start_sample@4
_AIL_decompress_ASI@24
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
dinput8
DirectInput8Create
ws2_32
WSAStartup
WSACleanup
send
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
htons
inet_addr
gethostbyname
socket
WSAGetLastError
ddraw
DirectDrawCreate
wininet
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetSetStatusCallback
HttpOpenRequestA
InternetConnectA
advapi32
RegQueryInfoKeyA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
LookupAccountNameA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegEnumValueA
LogonUserA
FreeSid
LookupAccountSidA
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
RegEnumKeyExA
RegDeleteKeyA
shell32
SetCurrentProcessExplicitAppUserModelID
SHGetSpecialFolderPathA
oleaut32
VariantClear
SysFreeString
SysAllocString
VariantInit
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 491KB - Virtual size: 490KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 186KB - Virtual size: 468KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ