25dfdf2605e18dd7c6c0477757a29e9f7f51a2dd12886d142fac7466d0b8c3e2

General

Target

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
Size

29KB
MD5

301df7f319137ef266221720ee8b3530
SHA1

1b4787d8df0e9029b55fd81afeb3ebb6ea09973a
SHA256

25dfdf2605e18dd7c6c0477757a29e9f7f51a2dd12886d142fac7466d0b8c3e2
SHA512

d105c3b94aa92c0077a4531be6ef15c07d0a2eac6f5a1f0e3501cd9a6db206890c5233a05a811577dd4073acb3e4104fdeb311589fc5e91a751a68771a40682f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/K:AEwVs+0jNDY1qi/qi

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

1188 services.exe

pid	process
1188	services.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/644-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/1188-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1188-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1188-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1188-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-30-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp2902.tmp	upx
behavioral2/memory/644-168-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-174-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-175-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-179-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-180-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-184-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-185-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-203-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-204-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-207-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-208-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1188-222-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-221-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/644-223-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-224-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/644-227-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1188-228-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
File created	C:\Windows\java.exe	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe

description	pid	process	target process
PID 644 wrote to memory of 1188	644	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe
PID 644 wrote to memory of 1188	644	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe
PID 644 wrote to memory of 1188	644	301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\301df7f319137ef266221720ee8b3530_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2902.tmp
Filesize
29KB

MD5
eb7fb7757a64105ef8e0acf2e6bef7b2

SHA1
24f02ab1a1fbfc3a78be96e308d5976eda6c8a7e

SHA256
dfbf642870ef1abb29749f6af2080f3706c5e6ea09666dd019e529896fa9775a

SHA512
dba20b2506506225e36d26506da7ab5bad9e14d9d8f47c7f7002013e075b6038ec5f81429ec5809904ed1027591190a9f578294510fb3a2a23e50aecb05b0cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
5c31469589e668d4b07f7de566399f13

SHA1
8aaf4e4584e0d0bb0d8a46bd17532748ce657790

SHA256
2b7678c33f53846d2af785761a08991d41405621ea66b460bfe67ac35180970a

SHA512
bcf882e05ea1a1ef5e4e35ed74d776e30f68c03df2f68d941abef5f66634029991455931f829e763804381815a5d8c3698f13c5606309ba7d537788dc2cb69af

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
e56a81bbaa700c265d6b3fb96a8a52ac

SHA1
0f2196801dce11e647740f0a14d54ac054dcc5b6

SHA256
6239dd9b161240c98416c55f9e7cf1bca17c76c68d590455d783741dde758c59

SHA512
e4e37af17ff2e11102ab831240dae1c6253731e4c380d03d636548fb9019d1ad58998c9b883e7206e2d52517315d12fcc315cd2c569097a2ca600959b030a054

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
46bbe380c9e2d7698b5112340d0435d4

SHA1
d4da5c499dd6645c84661fa71dc98e1c08e35a44

SHA256
7906ff03b5890f54b07ba0acd585e970f085038a9f40c68f69f778ce73ae845e

SHA512
94b1f657993a158fe8ca921cbdd6e43ab90b5f63d9961ff61257aa2d357c1e0f04809112d4f219999f27ed436856e0967bf8da379b5ed9b0f5e31738a9a2d1d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zkvQE9C.log
Filesize
288B

MD5
97d57c3f4e97e127dbfe0878cabe64ce

SHA1
4828fe6a4979f7765c81bccfe0077e6593dc4185

SHA256
76471670653a9d5df6b4d09f99351ced1146f104ae28898e54b798b3193d2200

SHA512
e24d1c7662f597437bde2cefbea80fb60d8de244119d831f0ff110a656ae724a01cf43a0634bc25ccdc9d69c4d43ea5143eec8381d04480c4cf00f3b75039ae1

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/644-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-207-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-30-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-203-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-221-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-223-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-168-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-184-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-174-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-227-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/644-179-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1188-175-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-180-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-185-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-204-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-208-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-222-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-224-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1188-228-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads