Behavioral task
behavioral1
Sample
48dcc5d3f69a070a85121698f5a0cb30_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
48dcc5d3f69a070a85121698f5a0cb30_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
General
-
Target
48dcc5d3f69a070a85121698f5a0cb30_NeikiAnalytics.exe
-
Size
156KB
-
MD5
48dcc5d3f69a070a85121698f5a0cb30
-
SHA1
0f341e687aa74dd2401d7d5df8693173e2bbc707
-
SHA256
d207f3c682eee53d24ceb38fb095b25260c6bb3f80bc29802940f1e167162e26
-
SHA512
8fd05523cb5dcadc13ecca0a628b754077b8abceaa5da11d7486bdd69481a45a4625bd01a32b96024e3815ddc31c890fe2a6bc729ef42e27d4dd620a05086478
-
SSDEEP
3072:iUpcSKyRj+o91NRPz6N+TBflnno/yBIUeOjT4U7j8Ap:5iXI/1NRr6N+TBXIAjT42jL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48dcc5d3f69a070a85121698f5a0cb30_NeikiAnalytics.exe
Files
-
48dcc5d3f69a070a85121698f5a0cb30_NeikiAnalytics.exe.dll windows:4 windows x86 arch:x86
afe929a2bc6373a2c3c3525a9976770c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
CloseHandle
VirtualProtectEx
OpenProcess
GetCurrentProcessId
GetModuleHandleA
VirtualProtect
GetLastError
GetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateProcessA
Sleep
FindNextFileA
FindClose
FindFirstFileA
VirtualFree
LoadLibraryA
GetFileSize
GetLocalTime
FileTimeToSystemTime
GetFileTime
CreateFileA
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
CreateThread
DeleteFileA
WriteFile
CreateMutexA
GetComputerNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcAddress
WriteConsoleA
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleWindowInfo
FreeConsole
AllocConsole
SetConsoleTitleA
GetStdHandle
GetConsoleScreenBufferInfo
ReadFile
SetConsoleTextAttribute
SetStdHandle
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
RtlUnwind
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
user32
ReleaseDC
wsprintfA
gdi32
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteDC
CreateDCA
shell32
SHGetSpecialFolderPathA
urlmon
URLDownloadToFileA
ws2_32
send
closesocket
socket
htons
connect
inet_addr
recv
WSAStartup
WSACleanup
shlwapi
PathFindFileNameA
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ