6d28d3540df44639550475cc11d72857e2fe990dc08a5991380e2852a9a90c9d

General

Target

5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe
Size

29KB
MD5

5c11da8405aa42e4115ea09ecf5813d0
SHA1

affed8dc35910e539ebaea00f6853a184ffc6eee
SHA256

6d28d3540df44639550475cc11d72857e2fe990dc08a5991380e2852a9a90c9d
SHA512

0036f6e006c14f9e86b584b6d8f95df45e897021036a7d5d093abbce9884d6111e47bd54d1752f3d7ef52007be2f58c5a75c8ba16760f6a653d798f0f1416d1c
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/XE:AEwVs+0jNDY1qi/qfE

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

4408 services.exe

pid	process
4408	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4036-2-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/4408-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4408-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4408-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4408-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4408-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4408-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp81C0.tmp	upx
behavioral2/memory/4036-146-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-147-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-150-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-152-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-153-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4408-158-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-176-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-177-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-183-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-184-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4036-187-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4408-188-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

services.exe5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

Processes:

5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe
File created	C:\Windows\java.exe	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe

description	pid	process	target process
PID 4036 wrote to memory of 4408	4036	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe	services.exe
PID 4036 wrote to memory of 4408	4036	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe	services.exe
PID 4036 wrote to memory of 4408	4036	5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c11da8405aa42e4115ea09ecf5813d0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp81C0.tmp
Filesize
29KB

MD5
8421bb343f769ea95805b7e406a638f8

SHA1
8717419377cf493eb220cf43cbe36fbb9f6cb029

SHA256
0f46df90df0de880491bf131b8648de97425e0ace79e2e9865ebea20284f7d70

SHA512
af7d2717d14d452ea13fa5044d6d4b889b86b41b09bf4783d356e508bdd2888751a832b164cfb905226921bb0331f618c8a039d436d0ad2d46d6b42a81a212f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
352B

MD5
e227bd038719eec4da92c0cbdd63fd1f

SHA1
1df7abe1cc9fb3f0a8c32e889a17269b24faa6b1

SHA256
1ea3e189f6bbe4110619b57bd84a6768b428284846fe17e6aa0fcf3b080ac86d

SHA512
ef7dd7dc62d8396fb333f5f40837471146bcdac36f8be5230fee7126d28a4823f9e5411ae421068d30376921891439357c4fc1a60efe7d098cfe891375071b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
352B

MD5
8e9c8bb2d3398db0256e441ec3d2d27b

SHA1
1f412e5e12a7b179bf3b9704cd7d760d3ebe9937

SHA256
26d6c807f59fb709cc1d9c21cddc823694a99af3bc4952dba79d198b2b1b70cd

SHA512
8b1b863f98497982046d5cd518f1aa27d5c2ade89e836fb7ccd20c112e1abdf77338e833c2d83f242fa1d0d83e9366fb372db244d86a6039dcd2d1ccf102bbcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
352B

MD5
df289eacf8f65595fa9999fa90ba0100

SHA1
323183b0206bb82f0f3b7953a8bfed53e1afe204

SHA256
4c74d75588ce9cd6fce395ce2cba5bbfef333348cf875a2b357e2d85f7189c46

SHA512
e8fe46a903eb4639d961cdab2c5b27a84acac88a4653a27371dd78fe4d2ae937d81d7eae3edd4e9834cb5db18388ca22640b808b6ee24048d407b285e320125e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4036-187-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-183-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-2-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-176-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-152-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-150-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4036-146-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4408-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-147-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-151-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-153-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-158-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-184-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-188-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4408-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads