51ec3f1f4e2622951e62b5e08a08fce45dd88b083567107e4d2f4130729907d3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe
Size 42KB
Sample240604-2e2zmsed66
SHA256 51ec3f1f4e2622951e62b5e08a08fce45dd88b083567107e4d2f4130729907d3
MD5 0ee03797f22a071ed069ade964c0ec50
SHA1 8d7f71127fb4babb110df2cebcab460c6d2dc357
SHA512 333a58272d3f4ceacdeb60cafedcd67defe974654e87090ac311f752bff450e9c643523ce9c2ac61c89bc1e07f05097b7002c9ba94c6e809e81ffb80f195adea
SSDEEP 768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVV:tdAkXGqECcwYgw9PNSa0GI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
3664	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023407-4.dat	upx
behavioral2/memory/3664-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-152-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-245-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-246-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-250-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-304-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-322-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3664-332-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe
File created	C:\Windows\java.exe	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3664	4984	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe	82
PID 4984 wrote to memory of 3664	4984	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe	82
PID 4984 wrote to memory of 3664	4984	0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0ee03797f22a071ed069ade964c0ec50_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GWDVLYHR.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LT2C7GL0\GWDVLYHR.htm
Size 176KB
SHA256 8db814d086dd86c0182e9c7719b7f58003059330575f7837d8cc3592e956b1cd
MD5 87ad15d47634fee680241bde62f4c954
SHA1 c92eb7e262a88b76f08ac9f6bd5339bce05a73b7
SHA512 40390e0cbaa95d88565e57dd41e23494d595a80ba70f7e07c843e304e3b1cfffae0d5bc313d762d4bc447d8392e9011949d656bcf077370565bceb63ffb55a8d
SSDEEP 1536:4jnDsKoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPONIoamI1MGoamI1Md8DoXJ:0GIeGAzVCbS0ZK+QG58TJLWIetIe8GT
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchFB79H5FC.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TF1TYUIH\searchFB79H5FC.htm
Size 141KB
SHA256 2de27e16548bf330716add5171765c9adfe13f6995e3b175aff362c0193e1dd5
MD5 621d020df6179b0fbd661c98d8f17b5e
SHA1 f609eeb207f4da7113c2c0d82e5e21c7b807b1a3
SHA512 39b293ae60dabc5315ef8f00cde28d264fa003d89f5b5bf6331d6946a2d5c6bdc8dca6b65eae14d23fcccd64f1cdf63b64524436ef2955cf3d28398793a4de85
SSDEEP 3072:uWIed06ZDaqkeNSSwS//mf+rWJ5WvIvDCH8C9:uGkCc8
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[10].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y19NSK22\search[10].htm
Size 139KB
SHA256 27e50e6215e45ab1f404bb86a70653a3248da569c7c0ce0d89b72d7253a56842
MD5 35d928fd18dca88032208b60f1b52dd3
SHA1 ab4897b9ad451ac1e5c3e1ecfa4707595371aad5
SHA512 c085d66a3d78254da3f1b286f00022666492903f40220d24b86a214d079cf53ff2391ed336dd3eee5cfa8681e399e9d8a4183ec2ec3b6884f21bfe81b488bcbc
SSDEEP 3072:SWIeapX/FY2Gv0GsSp+08F2Wq+zd7s4i8y8Z8r8K828Y8r8nn0efMq:SNF8gRvfmwnTFwn0Wp
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y19NSK22\search[2].htm
Size 112KB
SHA256 4901be31618752a488a10a935f4fa86917f4087f1da5b59f13aa94b78e830257
MD5 d2666ad10f94b69bd6fce425deb0a4d9
SHA1 de03ea50d5009285e0a1cf6097ad93d614dcf7f5
SHA512 a30a4b537b6fc665608f3715925ddf8a554680fccb41b2590c447aadf9340d14c22e9b8c1bd136d1236f6ffa1222d524e03805d97d01c8934ae7320bcaabfcc6
SSDEEP 3072:KWIegtF66MWom0ogbeInjqcLsG8u8f8FheFyD:KjFHcmbkzeoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NRRTXS\results[5].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NRRTXS\search[2].htm
Size 114KB
SHA256 6879833fc557a9006ae057f3a7f7b73d6e3968ce1d5f417f5fb333bd72c62c39
MD5 d59ccaba2b732280c5bec169ed24e8d0
SHA1 6bd7a9e6eca4f221f2c5a329898037eaea19db93
SHA512 e05febebab85e69452b1395ef6af6bb6508064081effaa6c4c7dfdc000a3da484e3e5d07a5cc4820efa9d23b87c840ca03669288cc9443051eca7fe976941db2
SSDEEP 3072:sWIeiToICrXhgA+7D4UWpqQNFBIGjBEGjszsVcTGT6TKTgTDTyT1TyTiTdaTjTid:sLToICrXhgA+7D4UWpTNFBIGjBEGIAgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NRRTXS\search[3].htm
Size 111KB
SHA256 d2c732f18077f7a81287193b3233928f5b33103ad0cac53d268e7e2d1dc7db56
MD5 c24163637ead5275efb1cbf23f0db472
SHA1 9763876eb9b51f7011e9e2dd20c89a45915922d2
SHA512 f81279833c2a8f54bddb481021816a46fc7432b37d8ea396d9e4690df1fb5ec52dd36c4446fc26f42d0caa8ce71a9c56cf69d35b791133fb5b8bd38869a20fd4
SSDEEP 3072:aWIeOiF6L7ZJLjUiOxR4A5K8g8L8Y838B8R8H8t8cKRH:aYFZdQFs+ucSc2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[4].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NRRTXS\search[4].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

tmp5280.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5280.tmp
Size 42KB
SHA256 fa7a023411459b633c3ff8418f7d0c2fd3120cdf9bb87767dbca65bb70545945
MD5 2c1681e0070677e6f2cd54086d151d96
SHA1 dd9e81cc6f2727931889802915fe3c860ce16abd
SHA512 32d10f6fbe30ef110534da845f7a6f4d59861cdad914cc9e4ac1b56301fb593cc648642d5fdb764cc5b5babc1080687a8926cbb5063268b45997930d4ba622f6
SSDEEP 768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVy:tdAkXGqECcwYgw9PNSa0Gv
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 a559f42a7bb06a2d4bcae0af9b7ad8dacc5713642851addfa3aa90613c252ff8
MD5 0e41878187c73baf154183bf94f854f0
SHA1 d9f6dcf059fa56cd25862b3596edcabc516cacdd
SHA512 e3c578d4ec55de8d55a64a2e5f303ae6d19c6feaacad813d871b239670f7b3f2a8a8d6af8094ecd74f049f678892b8a5dcb087071ea62ccf258a0a9adf8f3058
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 4709d296df95c322204c0eb3770759119a8a9d2f2fa2ab4dcd562b9ad9cd8b2c
MD5 a6ab7f86f446f14cf5e85824ebf55102
SHA1 a87ffe93560d09906e1a7206d23fbd87246b7b5c
SHA512 b2e41eb4a4286c5412ef9e302aa0b7d2879cac2d3a5c3f7fb3fc97f365775abfac880beadae99e336939fdd5a8f18ad7f2d88845958ba228ed21b99b691dd771
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 0dca68f061bd9bb28d3f096f1011fafa564c843c230a1d756c631f9bb82ce91c
MD5 50844d6a0f3b510d4d6076c3552ed552
SHA1 2e0f5561bdc9203248ffab919817deb95b7b40b3
SHA512 69facd9a1e2693c8df697f9aee347a938dc61d92dbcd2530f68e8609aa7a752ee13074e7298f77176a580107249b76ed6b087f709f0bf3c708def6e64c426a11
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 fd5fadf73ce43d37858c3254f08e2e7e054bd36c0b7fba88a2bc71bba33e8ce2
MD5 1a089fca53764b62302fca885390c3a5
SHA1 4efe29843f6d5d8988c1f1031a2b423b4f22ffcd
SHA512 762d08ee2c33038cdd223f94ae9f4da516513f214c1c49f181c709c20b96bc55c6b03bf2a8708fedf93661a2fda1b36bb2577a22702b3073da4bfd40c331c795
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3664-22-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-250-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-152-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-30-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-245-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-246-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-7-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-304-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-21-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-322-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-17-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-332-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3664-13-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4984-0-0x0000000000500000-0x0000000000511000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads