25dfdf2605e18dd7c6c0477757a29e9f7f51a2dd12886d142fac7466d0b8c3e2

General

Target

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
Size

29KB
MD5

301df7f319137ef266221720ee8b3530
SHA1

1b4787d8df0e9029b55fd81afeb3ebb6ea09973a
SHA256

25dfdf2605e18dd7c6c0477757a29e9f7f51a2dd12886d142fac7466d0b8c3e2
SHA512

d105c3b94aa92c0077a4531be6ef15c07d0a2eac6f5a1f0e3501cd9a6db206890c5233a05a811577dd4073acb3e4104fdeb311589fc5e91a751a68771a40682f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/K:AEwVs+0jNDY1qi/qi

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

316 services.exe

pid	process
316	services.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2184-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral1/memory/2184-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/316-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-47-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2184-51-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/316-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpBD1A.tmp	upx
behavioral1/memory/2184-75-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/316-76-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2184-79-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/316-80-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2184-81-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/316-82-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/316-87-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
File created	C:\Windows\java.exe	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe

description	pid	process	target process
PID 2184 wrote to memory of 316	2184	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe
PID 2184 wrote to memory of 316	2184	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe
PID 2184 wrote to memory of 316	2184	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe
PID 2184 wrote to memory of 316	2184	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\atbdeE.log
Filesize
288B

MD5
ca1051b3ef32313fcea8d9df427cba43

SHA1
c84849ec33a07c8d649f731fc7bd738101338c47

SHA256
124fda69e3ba3c40b60360aab56131ffe8a54e57f7f40b1cec76102ebcca5f94

SHA512
257fe2ba59ee5fad4fac66108fbf16b97a6ab62d17a127f64b8fdd38f9d14b253175ead591130ada3408c6da86d0b256624f05b966620bec5f599e31f190199f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBD1A.tmp
Filesize
29KB

MD5
ee84aaaf114360499be92de489c1774f

SHA1
da0b9de8ff175d5ef0f2261399cf7c5485da980f

SHA256
cb72e808d3b93bc1f9226e828ecf43f988931e42d8b11c4e10254cfdc5815aea

SHA512
21d899bb0fed71a730af6e563c87e8f85b73028b03fe6d5ac774ab20e6a22b4c33c15fb6c57673d4d384aafd894aa1cf78c49b7f867229971126f7855c5abc49

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
cb76c0e84c39cba6ad29043974bba9b6

SHA1
d6e0acf85cba3d463e83d48e2a60964f2b6bfe41

SHA256
3d05eaad0bb571946030112a25445e8ca8dd5cbfc93fae51f00c0b481770c973

SHA512
acc167eec7273342da30333da5c2aaa58ddc677d2877f36b0d87a88032feca5e2c0bdfa5cfb79341e068250e0c72636b7adc7ef8334098defb7a17def5f70cb4

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/316-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-87-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-82-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-35-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-76-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-47-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/316-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-51-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-75-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-79-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-81-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2184-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2184-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads