9704c5be13473d737addec321be98480_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9704c5be13473d737addec321be98480_NeikiAnalytics.exe
Size 1.0MB
Sample240608-hwfm7aaa51
SHA256 327f7a109e93b019586ab71d9cf9bd2d8b67e1e8339aebfc251903c471eedf44
MD5 9704c5be13473d737addec321be98480
SHA1 079d4a206730c21bc1078016c21210c0dc05d743
SHA512 57b4c7e66e9775a39d6522926349da5812f5ecf54cf86781777d13c52b26c4e8c2e94bc88f560d00271f61cc4ff125bd34d76d4c1f97c3c5183561380fcd4777
SSDEEP 24576:T6V6VC/AyqGizWCaFbyrVg9N9JMlDlfjRiVuVsWt5MJMsL:T6cbGizWCaFbcgFIDRRAubt5M
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9704c5be13473d737addec321be98480_NeikiAnalytics.exe

File Explorer

9704c5be13473d737addec321be98480_NeikiAnalytics.exe

.exe 1.0MB

9704c5be13473d737addec321be98480_NeikiAnalytics.exe

IMPHASH 476f1f35c8127c628ba01df1d9cea220
SHA256 327f7a109e93b019586ab71d9cf9bd2d8b67e1e8339aebfc251903c471eedf44
MD5 9704c5be13473d737addec321be98480
SHA1 079d4a206730c21bc1078016c21210c0dc05d743
SHA512 57b4c7e66e9775a39d6522926349da5812f5ecf54cf86781777d13c52b26c4e8c2e94bc88f560d00271f61cc4ff125bd34d76d4c1f97c3c5183561380fcd4777
SSDEEP 24576:T6V6VC/AyqGizWCaFbyrVg9N9JMlDlfjRiVuVsWt5MJMsL:T6cbGizWCaFbcgFIDRRAubt5M
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

173600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssh-agent.pdb

libcrypto

BN_CTX_get EC_KEY_set_private_key BN_value_one DSA_free EC_GROUP_get_order EC_KEY_get0_private_key EC_POINT_is_at_infinity BN_num_bits RSA_blinding_on RSA_size EC_POINT_mul EC_POINT_new EC_KEY_get0_group BN_CTX_new BN_cmp BN_sub RSA_new DSA_new EC_KEY_get0_public_key RSA_free BN_CTX_start EC_KEY_free EVP_aes_128_cbc EC_POINT_free EC_METHOD_get_field_type BN_clear_free EC_KEY_set_public_key BN_new BN_div AES_encrypt AES_set_encrypt_key EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_set_app_data ECDSA_do_sign ECDSA_SIG_free ECDSA_do_verify ECDSA_SIG_new DSA_do_sign DSA_do_verify DSA_SIG_new DSA_SIG_free EVP_sha384 EVP_md5 EVP_sha256 EVP_Digest EVP_sha1 EVP_sha512 EVP_CIPHER_CTX_key_length EVP_aes_256_cbc EVP_des_ede3_cbc EVP_aes_192_cbc BN_CTX_free EC_GROUP_method_of EC_KEY_new_by_curve_name EC_POINT_get_affine_coordinates_GFp EC_POINT_oct2point BN_bn2bin EC_POINT_point2oct BN_bin2bn RSA_public_decrypt RSA_sign

api-ms-win-core-console-l1-1-0

SetConsoleMode GetConsoleMode WriteConsoleW SetConsoleCtrlHandler WriteConsoleA ReadConsoleW GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA GetConsoleCP ReadConsoleInputW

api-ms-win-service-management-l1-1-0

OpenSCManagerW OpenServiceW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW GetModuleHandleW GetModuleFileNameW LoadLibraryExW GetProcAddress FreeLibrary

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

StartServiceA RegisterServiceCtrlHandlerW

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter SetLastError

api-ms-win-security-base-l1-1-0

IsValidSid RevertToSelf GetTokenInformation IsValidAcl IsValidSecurityDescriptor DuplicateToken CheckTokenMembership IsWellKnownSid CreateWellKnownSid ImpersonateLoggedOnUser EqualSid GetAce

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle SetHandleInformation

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe PeekNamedPipe CreateNamedPipeW

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-0

GetNamedPipeClientProcessId CreateNamedPipeA SetConsoleTitleA GetComputerNameW

api-ms-win-core-io-l1-1-0

GetOverlappedResult GetQueuedCompletionStatus CancelIoEx CreateIoCompletionPort

api-ms-win-core-processthreads-l1-1-0

ExitProcess TlsGetValue TlsAlloc QueueUserAPC CreateThread CreateProcessAsUserW OpenThread GetCurrentThreadId GetExitCodeProcess TerminateThread TlsFree GetStartupInfoW TerminateProcess OpenProcessToken CreateProcessW GetCurrentProcess GetCurrentProcessId TlsSetValue

api-ms-win-core-registry-l1-1-0

RegDeleteTreeA RegCloseKey RegOpenCurrentUser RegSetValueExW RegEnumKeyExW RegOpenKeyExA RegDeleteKeyExA RegOpenKeyExW RegDeleteTreeW RegQueryValueExW RegCreateKeyExW RegCreateKeyExA

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ResetEvent WaitForMultipleObjectsEx SetEvent CreateEventA SleepEx SetWaitableTimer CancelWaitableTimer WaitForSingleObject

api-ms-win-core-file-l1-1-0

GetLogicalDriveStringsW SetFileTime GetDiskFreeSpaceW GetDriveTypeW CreateFileW CreateDirectoryW GetDiskFreeSpaceExW SetEndOfFile FindNextFileW FindFirstFileExW GetFileType GetFileInformationByHandle FlushFileBuffers WriteFileEx CreateFileA WriteFile DeleteFileW SetFileAttributesW RemoveDirectoryW GetFullPathNameA GetFullPathNameW ReadFile ReadFileEx GetFileAttributesExW FindFirstFileW SetFilePointerEx FindClose

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak

api-ms-win-core-heap-l2-1-0

LocalFree

crypt32

CryptStringToBinaryA CryptUnprotectData CryptProtectData CryptBinaryToStringA

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle SetCurrentDirectoryW GetCommandLineW SetEnvironmentVariableA SetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryW ExpandEnvironmentStringsW GetCommandLineA GetStdHandle

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW GetSystemTimeAsFileTime GetLocalTime GetTickCount64

ws2_32

WSAIoctl WSAGetOverlappedResult WSACleanup WSAStartup WSASend GetAddrInfoW WSARecv closesocket WSAGetLastError gethostname WSASocketW bind getpeername getsockname getsockopt listen setsockopt shutdown socket FreeAddrInfoW WSADuplicateSocketW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l1-1-0

CompareStringW MultiByteToWideChar WideCharToMultiByte GetStringTypeW

api-ms-win-core-console-l2-1-0

ReadConsoleOutputA WriteConsoleOutputA FillConsoleOutputCharacterA FillConsoleOutputAttribute GetConsoleScreenBufferInfoEx GetLargestConsoleWindowSize GetConsoleCursorInfo SetConsoleScreenBufferSize FreeConsole GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleCursorInfo ScrollConsoleScreenBufferA SetConsoleWindowInfo SetConsoleTextAttribute

samcli

NetUserGetInfo NetUserGetGroups NetUserGetLocalGroups

logoncli

NetGetDCName DsGetDcNameW

wkscli

NetWkstaGetInfo

netutils

NetApiBufferFree

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-security-sddl-ansi-l1-1-0

ConvertStringSidToSidA

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

sspicli

GetUserNameExW

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-localization-l1-2-0

GetCPInfo GetOEMCP LCMapStringW IsValidCodePage GetACP

user32

FindWindowA ShowWindow GetWindowPlacement

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeap HeapReAlloc HeapAlloc HeapFree

Name

.text

Size

278KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

9704c5be13473d737addec321be98480_NeikiAnalytics.exe

libcrypto

api-ms-win-core-console-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l2-1-0

crypt32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ws2_32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l2-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l2-1-0

samcli

logoncli

wkscli

netutils

api-ms-win-security-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-io-l1-1-1

api-ms-win-security-sddl-ansi-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

sspicli

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

generic