1b978ef8ad4d61613db51f42be207363134ba0c39a43bdbaa0a69e6bc085bf0a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
Size

90KB
MD5

47b304bd12d44efe0a16cc5d6cec5e60
SHA1

615070f7de408b5bc2289a1523bb53726c1d89d5
SHA256

1b978ef8ad4d61613db51f42be207363134ba0c39a43bdbaa0a69e6bc085bf0a
SHA512

d2b2be8693a6d05e3c3966270598baece071c01ef4903d69cd1158e75d03f4401cdf24fab487f7b3912cea5817de0f67820b38226a62503e0d9fc6903769dbe8
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSIAJEYie+v1rio5dBvvv:5JjcF8KfCOcjk+guPVjSzmYie+voo53X

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000016c30-6.dat	upx
behavioral1/memory/2852-3-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/2852-34-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\MSN.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\password stealer.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\babes letting dudes assault their furballs.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\horny housewife looking for some action.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\horny little blonde spreading pink.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\movie of mom who whip hot ass on daughter's big cock lover.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\Blonde and Japanese girl bukkake.mpg.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\honies letting dudes flush mouths full of hot cum.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\sexy pink pussy girl taking it off.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\babe doing boyfriend and his buddy.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\hot anal sex for the first time ever.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\hard 3 way fuck in car shop.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\dude getting off in lover's mouth at party.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\Website Hacker.exe	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\horny teen waking up with her pink pussy spread.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\nasty teen posing in panties.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\old man fucking young blonde teen.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\tiny little virgin showing off her cherry pussy.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\maid's vagina plowed by big cock.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\macromd\old lady in bra and corset with dildo.mpg.pif	47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47b304bd12d44efe0a16cc5d6cec5e60_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe

Filesize
82KB

MD5
c617f1a93b3c72c9a929a2a368855237

SHA1
c849ea1c57d0847780d7d0e1338777e9b175b2bc

SHA256
70f9f92105f6a153a48593a1c619d4b863786f30f9017f50a57353ca14b6b217

SHA512
1864f5932b9534dd61f204b0536075aa1aa95811441d7aa0526c7ef7d1378185d194230311f48c1582df815fbbf434f40f279b1372af4a1ff3ef722c7c493b72

Download Submit
memory/2852-3-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2852-34-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads