Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 12:03

General

  • Target

    a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe

  • Size

    126KB

  • MD5

    a2bd0c02b2adf071bfb1d44096a35b30

  • SHA1

    47cf82820061a38b613340807a442b88d9238ef2

  • SHA256

    df6469992e7a082ab74f8eae1c235f25aac9fbee1ef549a30d0939a63c5ef80a

  • SHA512

    634483948d71eecdba60406bee12294a0acf4cf2689c351ed6bac58e5b11ce45d27eb11f678f9a06250c67c6cf1ddec3e839d46cbe136eddbec5d8ad538e7b2f

  • SSDEEP

    3072:NEboFVlGAvwsgbpvYfMTc72L10fPsout6S:SBzsgbpvnTcyOPsoS6S

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a2bd0c02b2adf071bfb1d44096a35b30_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\wininit.exe
      C:\Windows\System32\wininit.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 0
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 0
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA

    Filesize

    108KB

    MD5

    f697e0c5c1d34f00d1700d6d549d4811

    SHA1

    f50a99377a7419185fc269bb4d12954ca42b8589

    SHA256

    1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

    SHA512

    d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg

    Filesize

    126KB

    MD5

    0ecadef2f398bd9e2098ae9d43c254f5

    SHA1

    d6ecbebd170a2749843c8cb175ef5a6f34f57e6e

    SHA256

    a03d7e126d268fe43ce379a317c7ddfb6a71544722c385c523836e2099962353

    SHA512

    f3dde0f37beeaef48ccc8b41607d803b67a50f930a09eeaa2caea36971a3a471e55a94cdad941573fffd86f9a60703abec31420392e82bc48a9133d260f99ff9

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini

    Filesize

    711B

    MD5

    d0c40a30a848f67d3af538767d04f66d

    SHA1

    07a61656a63e1ce45f6aee178ee69673a97dba61

    SHA256

    80e2a5f804a203137d28af84add8f08bfd6a21fdef628364692928dc9fbfefd5

    SHA512

    c2d5987068f74b8e31ac1c6861b75e65dc97653206737ddea24cb7a741c5cb500431ffe2987e39e20a91b284b8b597033e25b2bd146a315ac0cb95bb630216f5

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini

    Filesize

    22B

    MD5

    2056c975629bc764596c2ba68ab3c6da

    SHA1

    35e3da93ce68d24c687e8c972f8fa2b903be75b8

    SHA256

    8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7

    SHA512

    c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt

    Filesize

    87B

    MD5

    4bcb288391556ba45a887ba5926390f8

    SHA1

    5c2341b12d5d761e53a1257ec46ea490ecbbc51c

    SHA256

    352d9f15ec52e995a4ca93bbd40d2236e5ae6e395e16c0e7e37e5ecaf1009083

    SHA512

    90d7a5f6b0d50b7f5a2f63e5b31ba2a0f97cdb016ee11dbac81bc8d155edb060355215dc93a02f910a88a5d92f3da8fe7874b5be82a1653f4ed788c44031dbca

  • C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg

    Filesize

    126KB

    MD5

    aa416764f97d47882381aa1fcc98be37

    SHA1

    157a898b2c5838de52c194a05379422298350f33

    SHA256

    e69a54616bfa2d81a1ff632b42c2661013e4b97417a29d2fab9277f5041781f5

    SHA512

    9e8a0cc390470940d139a3ad37ba314632ee4b0f0876a7602089783c7f13565bad886ec57c435706ba4062a13b1997635d61432e245097dd69d1b6ff2b001546

  • \Windows\SysWOW64\kernel64.dll

    Filesize

    1.1MB

    MD5

    9b98d47916ead4f69ef51b56b0c2323c

    SHA1

    290a80b4ded0efc0fd00816f373fcea81a521330

    SHA256

    96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

    SHA512

    68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

  • memory/1628-172-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1628-223-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2124-9-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-21-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-25-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-23-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-19-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-17-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-33-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-32-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-31-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-29-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-27-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-15-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-11-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-2-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-13-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-5-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-7-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2124-3-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2692-73-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2692-100-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-88-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-98-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-96-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-92-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-90-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-86-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-84-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-82-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-80-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-94-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-78-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-77-0x0000000000130000-0x0000000000185000-memory.dmp

    Filesize

    340KB

  • memory/2692-75-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2692-74-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2692-70-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2692-69-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2692-222-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2692-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB