bfccbb929a14b8f43824c57f57daca68d8e920e0bff08dee146049b6671dde87

General

Target

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Size

29KB
MD5

935ac65840d05b241d880e4854e513a0
SHA1

95ffa46a81f942264d06854d94bbf570cba695b7
SHA256

bfccbb929a14b8f43824c57f57daca68d8e920e0bff08dee146049b6671dde87
SHA512

3392a89cba6f6011390a57464568b8e5316e218b147152aba2c1618ae30050073788a79cc752eae9edf04d046087de5dc35cc39d6db0993e04181569e72beadd
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Y:AEwVs+0jNDY1qi/qA

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

4824 services.exe

pid	process
4824	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/984-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/4824-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4824-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4824-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4824-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4824-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4824-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4824-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-42-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpA1DC.tmp	upx
behavioral2/memory/984-189-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-190-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-191-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-192-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-195-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-196-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-200-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-201-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-227-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-228-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/984-239-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4824-240-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

services.exe935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

Processes:

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
File created	C:\Windows\java.exe	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

description	pid	process	target process
PID 984 wrote to memory of 4824	984	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe
PID 984 wrote to memory of 4824	984	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe
PID 984 wrote to memory of 4824	984	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fnsmluchag.log
Filesize
288B

MD5
5b78a6d7ca43c883eecd334b3c303162

SHA1
e20a0b626c4e5cf2843d4ed54bf10b4bdcfe3c1e

SHA256
4fb39a2f74be67c135bae16e1a3b183bb4f15828913aa7245d3ee16136b7b8f9

SHA512
701b7af2b9fd587fcc96c77daecafa8b67cc449b05cd7b5e34359c70ad7d74be789f71e748af8ab0a571590bde08698b18f34a64c06e59c8637a87aae84f40b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA1DC.tmp
Filesize
29KB

MD5
4cb7b38601ae5fca9d811cdb65f7717f

SHA1
396e0a040c5b6a8a8fc37a94d5555b60adfded7c

SHA256
4c0afcecd9aae6e705d80349fb64a6b612ae9f424fa2ce4c721c0d209dae2051

SHA512
ff51aae5b150ae63ff7c7146a8fa994a91c16047094c8848b88c57467655989eb5740b9013adcd54a4acaa6122ffac003134103475ac3f396c1662eb376a10c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
b0913adfa7f71935c85a16fd3d344744

SHA1
24f3f7ac07087b31a76cf45a1b47568a6572d522

SHA256
a703717dbf3dabcc0f5ab87a7292eb2782ae1d1e8669053bae6efefe23dac9b2

SHA512
aec8ea851268be13570455cbc54a98b2fa0da66fe1a70b1f9f921811202f6676bdea7e464a39fc457ef48019b6304c9e1ee7c37c622d4594b26fbba72dc9ed35

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
662b99eb819b209589362db93be315e9

SHA1
abeeb88f5a8df68502dd5985afef3a0d148adab9

SHA256
235d5d0f9d89f67870462d53562a8ad000436625023291095421d9ef99ee0f4f

SHA512
6a9eeea6a1d47ac206d7a4d708e0698e1e333d043d55472b56de8fe908644d6c94dda0cccacd74bd36c6a8dbb02cf90ea07acf7c853d69affe23f899bc5f4dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
31e156ee54b31feb7303e0b009063025

SHA1
b949cd5c937f84d8bae01fd53dae9e050e644e0e

SHA256
3b1976084c21ee76568b81478192c46008b7357043f59d1c552029c1f33644e2

SHA512
a1a136882a1be9ef075df1ea0570b21941983d7f3ef75c769bb43bffcf61c6c78a7ec17768ca9bcee62fba8de4c7455f489471c3836d5b76fbf12f654cf4af36

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/984-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-195-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-191-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-189-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-200-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-227-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-42-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/984-239-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4824-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-190-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-192-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-196-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-201-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-228-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4824-240-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads