�&�,�u8k�B �:c�0��j�>k�)3�����8��La`���pS����F����*8j{J'O �1ۿg;I��r{�v�i�B�@��G`[��������9c���HN�sU��}ߝR�.�3%���3��cͬ�^�a�r�!�\�q�<Be�<��k�DCBd#i�~��"�+�ؕ�k�ܷC�~Z������|�F��Tݑ^b�c$}{���[#� ��;!�^ά��'Ϋ?�95}��N���2�V�����K����yH�I�Wb:�-�,�d�+���h �Υ��c!��M�\m��ۇ��O�Y���]Y%O#zW�_q߲�6�l�3���`8��Oχ���"��7�9:��I<���x��>��'�3U(��x[�9�`��}[��@�-7�����j8+�_l/���c�c@�WST���/��\VL�����Ef�5J�>�x:��*L���Qn�� ��ʉ���P��{�dz�����W�6��q��F5|�}3����p�p�+O =MA�j�9�����k^�@����l��{ *�I��.� [�$�0���(��rc����%�r�}���B�[N��B�����v���V�hQ�,���l',g����>b���aQ[6tc9����:�;�gi�}/��b?�QM�8�o�8���Op�Cל�+[���u��o2FG ����bTH��'�&/`�e-i�5ޟF�~�YI~(������;�H'����/A�y)B=�ӝ�K;���#�&.=�;k<ڣ����)��M<��Fb�ĽQ#�{��m�h|�Rs_ߩ�]�s�ʯ��"�T�y'�����<�+&eV|Iv��Ҝ��o<h�����̉ 9i ]�?ӂ�u�7��w��/�<3���wn\ܶ1$���y���p9����Y;�zʕ�KP�3�����&)$����;�_1A��GH����bՏ��_�0]�_U8���!��bq��$>�q4���L�ĦCIm?2���<�㠓�ف����J�ac!kV�+F�_��1��� ���yMR:kk����+�NF��V���S��FʱD8o�*2���M�q#.~�/y�t�LY�[��Ή�ԉ�!G�I�!q����(����0��k|a##��|RVni\����mtQUhDd�EO=�#x�����W����Q���ύ �9����z� �E$�vO5���A#z[%��'�g��$��"���� ���l �<}y��"�k-����%i)�}�u�D����6v(���3`��e����w�&�5��b[�9���yt��J��G`�!���:ɵ/�����#(��1���9W��3�����2��WO@o����Xi����^�.� pR����(�qvQ;%�{ʢ�yZc$����y��p ���?�!�JT_����n�Yl-C�+�sOFA�P3\��stL#wK����f�o��l+�]|�l�_�6�M���҈?���lkZ���Z�R������ (������c��VI�#��4�Sf��iaUܻ�Mt��]�`�V�>�� T�u)}�S\Cil1AZ�,�e��ڶڶ8�3�<��k���Ų�������3�V,-凈9r~�B:����{8@e���Jߗ�̸*�^�-_���cH�Pq(�qZ����5��` Y�[��W �g��ۈ6=�)������{�r�i�1/w�Λ���J�B���gE�Uz9�9���!N�8#EDp=����0Cp�5�]8꺴z�L�����csa=l:���;�U6��jB��ץ��d��v��x7�/`��Ԃ�U��X�p��N�������NvSS�I���7j�=tbn�E2�MyR��7��K���1kҜKA" N�BҸD�LQ�^�b%������W���Xh�zÍē��/r��,�ܢ4���$F� ϑCn��b� cM�� ��ِ�ʑ1;N��}x������nB�K��w��$(�>�r�\�w�B���*���9�S��f¾*�镔��.s�_�E+WN�����"Y�-���Q�g�o$A��&r��S�^j��~�Iz�*;U8�fIچ���4��������kQ�����[W��� %����)�>b%M��OK��=�g-� ���^�K�L��#�"E�>�X$v6���}��@o�2����k@�{�f�|~�?���I�L��ʝ�X5 O�����!0�I.GAh9GV��\��*Z#J�%�ic.����HVq?m��΄B9A�!7H���o ,�,��c"o;��Uc�h����ɛ7 �ĺ�l��QمC��/�Pb�B���o%eF�e#��{ބ�d�A�W�J̨�e�-���g�MF��kǻ�f��D:9�*I�����j���vk�G"�L�f��YZj�k̇���l����'�Lj�}q.K� ������ ��!Dnh�x��NKg W�q�[H '� ��/DN��*�B� � ��P���<���Y���1�L�>�~``�5=ʒ��/ܯ*����pU� q��4���W>�M����%CL����XE��]����r�<���eZ��_���B٠s`������dwn����ph�\���3�渻)��.�Y/7i���?E/f�xcl�n���X���`���ș�q$��Jt���s3_ _���ۺr%��'�x� �,7�}N�P�E�*�G�?�e���*Q�qy2/�g�K2D����V[�@뗕��-]�� @^����&��ƾN3����� ��،�l��[f]�ì�@�N��%����V�����V~����R o�7�!��Ц ��hwy��}�Zd@' X��Y�Co��V�g*Bܔ�d��DZ�i| �$�Z�u=/�49&�:�y���a{�ʾ�#�x���0)�[�wEq��c�B�\�w��B�J롥�%]˪�&4s��*�<��D��u����Z�+i@����ظ���Kav��1US��5#�^��۹Y��҆0��MC�'�6'��)���_����D[�:�D<��yr�ղ�ʨ}/��>��w���� <g�]y��R`}�����5�b$R���ʂ��XW,fMMș
Behavioral task
behavioral1
Sample
2ce394574e87cbf44b872e40f0547710_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ce394574e87cbf44b872e40f0547710_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
2ce394574e87cbf44b872e40f0547710_NeikiAnalytics.exe
-
Size
8.9MB
-
MD5
2ce394574e87cbf44b872e40f0547710
-
SHA1
bb8249b9161ce8c8208619b3e99269de4097756f
-
SHA256
73c8a35810c53075041ebb3c065d4803525d79b6df307da207b1e478a5a00e74
-
SHA512
f108fd4dbf4d50c3ff13d52459de2fd8b80bd4dc90ff4c761aa90092bf14ef606fdec5dbceeac3f47f8e6255351f229f85637225f4168a002ba555f0ee8a4f20
-
SSDEEP
196608:81iJHt3GhygR1GpXLp+w6KI2FAiL/zREc7t2DBSxWY3B:PJN2hy+OFJxI2aiL/zRd7t2D
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ce394574e87cbf44b872e40f0547710_NeikiAnalytics.exe
Files
-
2ce394574e87cbf44b872e40f0547710_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
412c7e9a4af237fc644d8c6cbce8de87
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LeaveCriticalSection
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
RegGetValueW
shell32
ShellExecuteA
msvcp140
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
imm32
ImmGetContext
ntdll
RtlCaptureContext
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord79
crypt32
PFXImportCertStore
ws2_32
recv
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
mbstowcs
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
logf
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 367KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.9MB - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ