Overview

overview

10

Static

static

7

c05bc468e4...cs.exe

windows7-x64

7

c05bc468e4...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 12:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c05bc468e44951935a58c1323d48a070_NeikiAnalytics.exe
  • Size 29KB
  • Sample240527-prt4cadd73
  • SHA256 f7c4aeaa815f44454061199f2d8318724e333d1f4a7047fb1caf919ceaa6aee0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c05bc468e44951935a58c1323d48a070_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c05bc468e44951935a58c1323d48a070_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        3DWRQ3EW.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2PB2KMGY\3DWRQ3EW.htm
        • Size 176KB
        • SHA256 36cee9d7b59924cb62753550866278e55153c457b935a6c6881641ed8368dac6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2PB2KMGY\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        default[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2PB2KMGY\default[6].htm
        • Size 311B
        • SHA256 312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15
        • MD5 SHA1 SHA512
        Submit Download

        search7BT99Q3R.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2PB2KMGY\search7BT99Q3R.htm
        • Size 130KB
        • SHA256 8a8b643a2f5df8a0e2d367c6ca33872b264afa6f5f470daed15eeba23b22c602
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchHV8EN6A6.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2PB2KMGY\searchHV8EN6A6.htm
        • Size 141KB
        • SHA256 ae876187a0d69d123e5c07f6f5eead1af6940309085af1807ef9d6ec3ac906a7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\default[1].htm
        • Size 313B
        • SHA256 7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
        • MD5 SHA1 SHA512
        Submit Download

        search3P94CU7Q.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\search3P94CU7Q.htm
        • Size 152KB
        • SHA256 245384c2385755d47f154c89d384c68a4642631c060317037b43c5befbad7f77
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search8SWUXXC2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\search8SWUXXC2.htm
        • Size 115KB
        • SHA256 f2b9d3dc8216011f5faec12bee32257eee30009b3eec84f979b9ac7e8ca284f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\search[3].htm
        • Size 134KB
        • SHA256 ae6d33ffb4f27cbae16721778c034d4d3df75e0cd319fe55bc078ce7f4c7d7ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\search[6].htm
        • Size 101KB
        • SHA256 d77fabe841f10b0509268cb30b952a0ba9f47fc933b7684013c2e13b2521f378
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\results[3].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        results[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\results[7].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        searchQ23D0X6J.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\searchQ23D0X6J.htm
        • Size 138KB
        • SHA256 f8ae3d430349b7a351c2addc1c3a61ae80e845a288115bfa02beeab6474361a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\search[3].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\search[7].htm
        • Size 131KB
        • SHA256 ffe25cc11ab431d777381efb848882a28364ddcae2b5d87f6fe82cd689dee1a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\search[8].htm
        • Size 120KB
        • SHA256 d01401e402be43c5e3c29211390ba602490bfac12b4253a21717eb287876e7c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\default[1].htm
        • Size 313B
        • SHA256 1b949aeab999aed6ebea087159db61393d411edcbbf228b98f4b5c3d8711ad29
        • MD5 SHA1 SHA512
        Submit Download

        default[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\default[5].htm
        • Size 305B
        • SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
        • MD5 SHA1 SHA512
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\results[2].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchB7RUBR67.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\searchB7RUBR67.htm
        • Size 129KB
        • SHA256 268a05ac647a62453bf01f89de1ba6deed5413bcf81d18985915ee5b60755445
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchIZ7CJ67C.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\searchIZ7CJ67C.htm
        • Size 141KB
        • SHA256 c958e776441e4af900de92000633f264d08f1ef3d7a36da0920c93e57bfd9bb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\search[3].htm
        • Size 141KB
        • SHA256 36a3bd0b3c3a654cb2368c8391ebef65d3a7f08e2070397804d89833a9f56fc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\search[4].htm
        • Size 167KB
        • SHA256 9673a5d339d9eefd27db97ed9314c21e92e5c7bd378442c9eeb537497f9133a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\search[8].htm
        • Size 134KB
        • SHA256 003a3458ea1a70266e795636d6e983f647b9143f313295c901e430f7f83c1415
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K7TNQP8W\search[9].htm
        • Size 118KB
        • SHA256 0c91d2a51a1b264a0dd57ffd163307d369eccab7ea7e29913263ea825bcd5bf0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmpD59.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpD59.tmp
        • Size 29KB
        • SHA256 0d94391977439943e5144b143669756a90f781bcc8ba76869db7fcd362099f1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 cdadc8947d5c895297cf8f3a0e146e73bb97470438d00f38a2acc26776792b00
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 65cfab04e67b7bb16a3d3faeae29bb2270d99d5f985f6912fabc7b903d0cab3a
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 8ea54de038cc748ae155c2096985b28aa77347484c50616c7170fea279fb69bf
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 60ba5d05da66ecefe99b88a27943bb97c4df911803b40be8f8098630bc44ebe0
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 bf3bc29a2bd29ecf5647848310e1a8a72f1bc9ab0d0e6bdd7d9e4ea166bdb27c
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 320B
        • SHA256 550bb76cec8ca32ad37dc26e5a45682c85c2c8f792393addfa3f966c7fd481b9
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1652-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-650-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-927-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-800-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-370-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-519-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-208-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-246-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-77-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-241-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-237-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1652-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4168-649-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-245-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-207-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-518-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-799-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-236-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-76-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-369-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-926-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4168-25-0x0000000000500000-0x0000000000510200-memory.dmp
        Download