Overview

overview

10

Static

static

7

1cf3502677...cs.exe

windows7-x64

7

1cf3502677...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 00:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1cf3502677224d699b830c6fc48c39e0_NeikiAnalytics.exe
  • Size 29KB
  • Sample240529-ahmwcabc53
  • SHA256 72447fa2c716381d86e0546ce1cc4b79cc991eba9e4de01355f82547a415e6b9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cf3502677224d699b830c6fc48c39e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1cf3502677224d699b830c6fc48c39e0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1192

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\default[2].htm
        • Size 311B
        • SHA256 312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\results[5].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchQA4PQ7WE.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\searchQA4PQ7WE.htm
        • Size 101KB
        • SHA256 e160115992d2ea2a8c831e92f189f9e2426c80e1b99107a5a4421c30f6cb988e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\search[3].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\search[8].htm
        • Size 140KB
        • SHA256 15b4460d147bee5f057bae8379b1b9fa9440b2fc1d50b16a004cd44c6bee1153
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2GMA38VX.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\2GMA38VX.htm
        • Size 175KB
        • SHA256 12fb8378e4eeedc8371f9fe77d61bd88f40ab6ebd07e0baaedba4f5666f4ec4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\default[3].htm
        • Size 305B
        • SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
        • MD5 SHA1 SHA512
        Submit Download

        default[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\default[6].htm
        • Size 311B
        • SHA256 64e0b3228ff8de15e5a74e7ff8b7cd163fcbf638f6380aaa6fbee8e40cb2c1a1
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\results[4].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        searchK0OVLD9X.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\searchK0OVLD9X.htm
        • Size 143KB
        • SHA256 42b8b0f5b1437b524d8dc78a97c9bd329e9e1c32b1217f952ffec6fc48f99637
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchPFE5KH9A.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\searchPFE5KH9A.htm
        • Size 106KB
        • SHA256 278d72e6e30a47b05ca38334bfd8d5e907f2ff5f8a7edcb42632e60f875e8387
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DL7YY2B9\search[2].htm
        • Size 115KB
        • SHA256 d5df8b1f840bd0af580ad981ff1740e43d85141e1f2d483dd23f9b504c79ba9e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\results[1].htm
        • Size 1KB
        • SHA256 82a58c2ca69ad8e52efd5e0533150f12430f560ee56d885237b8e486be743b90
        • MD5 SHA1 SHA512
        Submit Download

        search37WWYJER.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\search37WWYJER.htm
        • Size 124KB
        • SHA256 bab0734f4711b5feb898cbb6033f8ff712ae49238a47c9236865d9d6c0a43b88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchOGQTVZQ3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\searchOGQTVZQ3.htm
        • Size 126KB
        • SHA256 0a31c897bff22296da3a6856f3e740c59085a29b350d17744af56133d8278fe1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchRGCZ37BN.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\searchRGCZ37BN.htm
        • Size 104KB
        • SHA256 213ddd103bce8df50b5d7fe05554b7845dcaceb9e5019a1381124ead3118163f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchSZUGUVHG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\searchSZUGUVHG.htm
        • Size 150KB
        • SHA256 95a88de94b87894c5b0783c8036dfb692ec526f88b7671cd40fc79c68619db66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchXOPR0OUH.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\searchXOPR0OUH.htm
        • Size 117KB
        • SHA256 6dfae442b0b8f095b142e9685030a568624896ca9ce9213332c462a1dbd90e56
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\search[4].htm
        • Size 148KB
        • SHA256 0f165aa1affde43f9e901390d6c9aa731815817e523c456e42cc45aa2a8ba8ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\search[5].htm
        • Size 103KB
        • SHA256 98ca7b0d59eb4db5b62aee4416cf427918d27ca8dcc4ed504b636525a5737f52
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\default[3].htm
        • Size 313B
        • SHA256 7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
        • MD5 SHA1 SHA512
        Submit Download

        results[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\results[9].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchBJOC2E9U.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\searchBJOC2E9U.htm
        • Size 150KB
        • SHA256 5f686f279dfd5bc751c2828ca111839799950056aa155f8db3547aa318f761b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMTYTGK8A.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\searchMTYTGK8A.htm
        • Size 131KB
        • SHA256 426f48f12a76ebbb55cdd16ca8de56e7cb7b8e2d1a72b3163c19411cc75c75cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZFXMSD92.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\searchZFXMSD92.htm
        • Size 134KB
        • SHA256 c2bee57755f824a16dd9aa6794a6d917a10bcc9211db81471f6ffd923a9ab837
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\search[7].htm
        • Size 151KB
        • SHA256 7c96d93bbe932514f275d60bab75c1e7bd08d1c2bbbef40902380767e8e71a48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\search[9].htm
        • Size 116KB
        • SHA256 5d88ee0a83f27c6e78ca67b23856e93113307ae5a8afe99b8a57d8b10455146e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp2CC8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp2CC8.tmp
        • Size 29KB
        • SHA256 aebc7afdceaae963eeceb0f2fc4d60e1de89aae5807b811e812f68dc4551a2b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 24eed74e59a3b0cbeaf0a334d9e320d996c15d35d3b84236624a6f305ba4c4c1
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 ca00bc45cbbda70a2563da08fdf949eeb2f7a4e8f001759a9dcfe77f638c21d1
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 82283a414b4067896fe16bf5a89a414b31964c1fb02534f1f41eb08516577791
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 795478a3a4e2fefece58edb3dac0075ef38c54b4faa566949912f41ee1967c73
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 e32793465fdb9e6b776534ce7b03297401fd005127d4709e3f2f740948d127a7
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1192-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-271-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-955-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-275-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-112-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-680-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-301-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-280-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-463-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1192-828-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3896-827-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-270-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-299-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-679-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-111-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-274-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-954-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-30-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3896-462-0x0000000000500000-0x0000000000510200-memory.dmp
        Download