Behavioral task
behavioral1
Sample
defb74e97725c3fd02f2596ed98680e0_NeikiAnalytics.dll
Resource
win7-20240215-en
General
-
Target
defb74e97725c3fd02f2596ed98680e0_NeikiAnalytics.exe
-
Size
127KB
-
MD5
defb74e97725c3fd02f2596ed98680e0
-
SHA1
d3b8048f556d69533130d77f42ec85c7f6fe3d23
-
SHA256
7a7d4d36fd62bffd75b37218e1bf7e34bf9706b18a9aab609197b864479f4fb3
-
SHA512
b52e1891894156930cfb30e7dd219e912abf1478d01247b0f60ace9ee3d7c09d555832daa27e21a921a9b41a917383af6f13fc19aeac927872d092e3395ecedb
-
SSDEEP
3072:OMbIWiyr7pjvTvoBFEbWwIUJlTBft3+x+D:OCIWiyr7JQn16lTBl3+x
Malware Config
Signatures
-
Ramnit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource defb74e97725c3fd02f2596ed98680e0_NeikiAnalytics.exe
Files
-
defb74e97725c3fd02f2596ed98680e0_NeikiAnalytics.exe.dll windows:4 windows x86 arch:x86
748f8e5a07c233ae071e8f9f57b0afba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
GetLocaleInfoA
GetLogicalDriveStringsA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersionExA
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalReAlloc
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
GetFileTime
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenMutexA
ReadFile
ReleaseMutex
SetEndOfFile
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
TryEnterCriticalSection
UnlockFileEx
UnmapViewOfFile
WideCharToMultiByte
WriteFile
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
GetFileSize
GetFileAttributesA
GetEnvironmentVariableA
GetDriveTypeA
GetDiskFreeSpaceExA
GetCurrentProcess
GetComputerNameA
FindNextFileA
FindFirstFileA
ExpandEnvironmentStringsA
FindClose
ExitProcess
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateProcessA
CreateMutexA
CreateFileMappingA
CreateFileA
CreateDirectoryA
CopyFileA
LoadLibraryA
CloseHandle
ws2_32
getpeername
gethostbyname
connect
closesocket
bind
getsockname
__WSAFDIsSet
WSAStartup
WSAGetLastError
WSACleanup
socket
send
select
htons
inet_addr
ioctlsocket
listen
accept
recv
user32
GetWindowRect
LoadCursorA
MessageBoxA
ReleaseDC
GetWindowDC
DrawTextA
DrawIcon
CharUpperBuffW
wsprintfA
GetIconInfo
GetDesktopWindow
ExitWindowsEx
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
GetUserNameA
shell32
ShellExecuteA
gdi32
CreateCompatibleDC
DeleteDC
DeleteObject
GdiFlush
SelectObject
SetBkColor
SetStretchBltMode
SetTextColor
StretchBlt
CreateDIBSection
ole32
CreateStreamOnHGlobal
wininet
FindNextUrlCacheEntryA
FindFirstUrlCacheGroup
FindFirstUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheGroup
DeleteUrlCacheEntryA
FindNextUrlCacheGroup
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ