3fd05d49ec653606b24e10d604d4e19723c5a9cfe844818764508d095856285b

Analysis

max time kernel
6s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe
Size

130KB
MD5

547d1862283cf98ea6bc173e52827c50
SHA1

cb1ec8704e16b78d75cad58d9f04d4141292e988
SHA256

3fd05d49ec653606b24e10d604d4e19723c5a9cfe844818764508d095856285b
SHA512

b8e12a0c96abf5c680f7b05ac54e38098c9e99e7c39193eeb34137926f9e8fb6de44311aa3dad1abaacfa222a2bc4a8f72a9eead0959757528f5a34bedf1cd28
SSDEEP

1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZ:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2276-75-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2276-66-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/143116-798798-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2276-798800-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/52056-798845-0x0000000000400000-0x0000000000423000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe	upx
\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe	upx
behavioral1/memory/143116-798834-0x00000000031E0000-0x0000000003203000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe

pid process

2276 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe

pid	process
2276	547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe"
2⤵
PID:143116

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\TGIDB.bat" "
3⤵
PID:106884

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
4⤵
PID:175540

C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
3⤵
PID:52056

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TGIDB.bat
Filesize
145B

MD5
da0cbe87b720a79b294147ed6a4b98be

SHA1
ebf0dc9efd7a12cb192e355cda87546acb4ab360

SHA256
7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

SHA512
f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

Download Submit
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
Filesize
92KB

MD5
05018f1abda02189210140113a1cf02e

SHA1
0e3f4ccf92cf6e7480bce0ae2a8fd0de8b532b00

SHA256
a0e3c9436e25dead596b18e9477240d2dcf3a59c5ee264fd42a05af60f233f45

SHA512
82a376cd13cbfda8345cc58e849c75fe98644d69748ffedaef131dbe97a5b2129577b15f436fcdecfdc66a7b34af9b1e9a6b8a29ab6533d7b54ec57b638bf3c6

Download Submit
\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
Filesize
130KB

MD5
204f4874b1cd359f4881dff3d04d6a98

SHA1
4ad1fbe86484d3f1704b2c571f29ef75533cc0d4

SHA256
2f11e697699116454bb45018aad1cbb0823ebace3454345ec68ab3b852c90d3a

SHA512
da0db2d7e055dbfe03f573e8442ad8a2b5000040ba6b97a85519d968c7457270fb80bba9f1bf853b7336fbe8f71f02a602181f6bceaa5cbc9511790721bbf9af

Download Submit
memory/2276-41-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/2276-57-0x0000000000416000-0x0000000000417000-memory.dmp

Filesize
4KB

Download
memory/2276-51-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2276-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2276-21-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2276-9-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2276-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2276-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2276-798800-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2276-75-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2276-11-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/52056-798845-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/143116-798798-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/143116-798842-0x00000000031E0000-0x0000000003203000-memory.dmp

Filesize
140KB

Download
memory/143116-798841-0x00000000031E0000-0x0000000003203000-memory.dmp

Filesize
140KB

Download
memory/143116-798843-0x00000000031E0000-0x0000000003203000-memory.dmp

Filesize
140KB

Download
memory/143116-798834-0x00000000031E0000-0x0000000003203000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads