Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
04/06/2024, 20:02
General
- Target f8eb659ae3b31e44ff369f42b7266460_NeikiAnalytics.exe
- Size 29KB
- Sample240604-yr991aae59
- SHA256 a10d22f265291dcca5b3da0f9889f9a8d4972f7953e96fcd72a4b6b53e3db522
Malware Config
Signatures
- Detected microsoft outlook phishing page
- Executes dropped EXE 1 IoCs
- UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8eb659ae3b31e44ff369f42b7266460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f8eb659ae3b31e44ff369f42b7266460_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
results[3].htm
default[1].htm
search9Z21RKM9.htm
search[8].htm
109UL1DP.htm
search6AA56SLL.htm
search[2].htm
searchH2649FKB.htm
search[2].htm
tmpB3DC.tmp
zincite.log
zincite.log
zincite.log
services.exe
memory/3432-281-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-5-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-152-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-43-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-277-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-324-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-48-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3432-283-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3780-282-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-0-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-323-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-280-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-276-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-13-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-151-0x0000000000500000-0x0000000000510200-memory.dmp
memory/3780-47-0x0000000000500000-0x0000000000510200-memory.dmp