95b4126240440bf3754a877a4c644d0ab529088c33ecf8adcaa53afb7e7f64b2

General

Target

745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe
Size

29KB
MD5

745b0d5808ceab776b2952bc3f246310
SHA1

d2233f675bf94b4280c8ef73ae47f0027911fd24
SHA256

95b4126240440bf3754a877a4c644d0ab529088c33ecf8adcaa53afb7e7f64b2
SHA512

1657d5af3e8c2fa6517b4f4699393bbd668b49e6463ec3d11b58e63aed2a75d0aec513f71b80e0de430d80f6bd56f924efc817a31342c93390fb6169b62b54e8
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/w:AEwVs+0jNDY1qi/qI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2292	services.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2292-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0037000000015ce3-10.dat	upx
behavioral1/memory/2248-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/memory/2248-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2292-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-53-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2248-54-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2292-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-63.dat	upx
behavioral1/memory/2248-76-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2292-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-81-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2248-82-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2292-83-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2292-88-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe
File created	C:\Windows\java.exe	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2292	2248	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 2292	2248	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 2292	2248	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe	28
PID 2248 wrote to memory of 2292	2248	745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\745b0d5808ceab776b2952bc3f246310_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hwkwpsnbnp.log

Filesize
288B

MD5
a44002d6209b9f8f72dfea9a51c1083f

SHA1
68850cd6288189d5670ae5cc860885666f2ce28a

SHA256
1c7561992acfc11a642d8671cf666482967e48258de24e835c5fbf9603baec8c

SHA512
117d37a22720ef7f45ad369dd8f5e2a68097983ef126feaaf7905ccad10be5d56a6fb149c04786662bc5f35ee760888c39766faa55d4cf1685dfb8d842bfd935

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC458.tmp

Filesize
29KB

MD5
f5a2ed40767b53b44970c6360bc75551

SHA1
d4365c6290fdb8c0b7b3d43a27122a33ca4b8e27

SHA256
ac248b840ca7bf31e40fde9197a5b2eb033839ca033a5499b27843ad2d205f9e

SHA512
efbf9f4dfb5ff7ac13a97d1d5ad2b9fe04d38e40c82e13f89c86066e90d2c4250fe0948e8322d059654af19637a40ab042b9e2301346ec2375ba1fa8f0a4e59e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
2aeaf322ea866bfc152c093961fed05f

SHA1
457a802d9d1424d730cf3ce00e470575f16cfbbc

SHA256
4972c424f91af5232ed0a97fc1669e60ec0864965b2cea8be71a02c922ae5877

SHA512
1b89af938cb024122a227071a5902c9782d9ec99f80fdaf5321d38b3409e6504fcc21ca4f4ebe49c90b4db4e20d66889ee1ab00f8666179f4cb35200d5ecc0ec

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2248-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2248-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2248-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2248-76-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2248-24-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2248-9-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2248-82-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2248-54-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2292-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-53-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-81-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-83-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2292-88-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads