Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 01:19

General

  • Target

    2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe

  • Size

    126KB

  • MD5

    2269b25cfac36601d7883f1c3536ec20

  • SHA1

    0b730ecc2a691f344e30e1e89a72e1897e28f50c

  • SHA256

    5be1459cb89a7426a91707678653b5a593bd53b5eed0a6f4817668971af3847d

  • SHA512

    80f169e6ef35a7f0c5407c54fb9521a3cfb8320960232a38334ddc191b00d7eac0d22e7e47749ca393b9be532524ca8a479fb476d28e495a9ed876d226849fdd

  • SSDEEP

    3072:4EboFVlGAvwsgbpvYfMTc72L10fPsout6S:HBzsgbpvnTcyOPsoS6S

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2460
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1768
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1740

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

          Filesize

          127KB

          MD5

          9cc6401dc698476c774c152701d5fd3a

          SHA1

          ab34a6b205e06f6f677139d3d73300d64bae2101

          SHA256

          628a3851d7ede8f27e3ad4a0a6a8b426922dba7c43a2dbb6a9497476a7fcbf88

          SHA512

          71ead35de9aa724f3f08bb6cd6ca1ef54585b0c30da174c38a3d82e34d647575ae6f9232f8963f2b416f25b92f31aeba0bbec308d6f9b3e6c42f859b081ee8aa

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

          Filesize

          126KB

          MD5

          f59d05bfa438a9df7f33099947c33ee9

          SHA1

          3df8e9135698a7b6be3d54d62e9915e0db739939

          SHA256

          e7777250da6a8ccfe88ae8ae667dce036e4ee88d2ea21f41da5bd9e886c95b3b

          SHA512

          65d49c61a9098ce9d9d3a923d690986d18572f49f1481faf198279de29be9d78e0b0251256175a689c42c8f8a5079ac4ebb40f5640a0ec84820c9ef08d5fc9e1

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA

          Filesize

          108KB

          MD5

          f697e0c5c1d34f00d1700d6d549d4811

          SHA1

          f50a99377a7419185fc269bb4d12954ca42b8589

          SHA256

          1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

          SHA512

          d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini

          Filesize

          711B

          MD5

          a9fa595fb25e867a9dd5776aa5ca015e

          SHA1

          40cc22c96280ea61aaf603650f5d4b4884f1a6ad

          SHA256

          3846d7b4e93c2e6f2de01ed7be252359855fbed36dfee4a34170d0439b619ae1

          SHA512

          36046a9a9567a15cd6ae99b9cc7803ce4a42ee9eed82d94bbda436c05cfc2cf6f0715a70bae463a6f13259f24dec5f508ae969fa2fb170a4c86436ed04bcd0d2

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

          Filesize

          22B

          MD5

          2056c975629bc764596c2ba68ab3c6da

          SHA1

          35e3da93ce68d24c687e8c972f8fa2b903be75b8

          SHA256

          8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7

          SHA512

          c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

          Filesize

          87B

          MD5

          1ee836a55c14e46ea1e0a75c52875d90

          SHA1

          ce5feca843f7c3efd0997e99ff41b2e182a66566

          SHA256

          4d8d08b98d3c324868b3459a807d64572666c114d84651daede007b0d561abee

          SHA512

          51369c1a734f0d3cdf32d2d6424214f4e04bb12d3cf703e4dd97176b8aab51bb57c237776efb2b4e1d6c98caa7cc1accec4461de8a791a90c3d3e5cccae69c8b

        • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

          Filesize

          126KB

          MD5

          72fba22c5e4e21fbac362d086fa57574

          SHA1

          06efaddee633e06ec2ab08a6118d9aae17683a86

          SHA256

          bea65abf17679fc1c808ada8df2c2ac4a04dfa5f82fa83bec9edcf724f014422

          SHA512

          b531625077f10766ae1f647153d7c9758749543a34c578ee770eb3fb2f4748388c10e1dc77832712c0dbb258e0d881e5942cd91eb1ed0de1eef6e49a2a1ee2a0

        • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

          Filesize

          126KB

          MD5

          c7152b3a4b58894eeadc0f569be45d1f

          SHA1

          6c6daff6f308e65680c8eb49f3ae6c04fed4990b

          SHA256

          1786e7fdc5b7f2b8516756303281ecc1fcfe38a78165a80e6631bd4ceb352f8b

          SHA512

          7ee7cb167c505108cb08d052e32dd6f65606697d1881e6cd0aa60fa2803eb68a0b789265777a795afa32295fd5f95a9977bd7a81ab1e5cee2993c4ffbaf681f0

        • \Windows\SysWOW64\kernel64.dll

          Filesize

          1.1MB

          MD5

          9b98d47916ead4f69ef51b56b0c2323c

          SHA1

          290a80b4ded0efc0fd00816f373fcea81a521330

          SHA256

          96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

          SHA512

          68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

        • memory/1660-5-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-29-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-23-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-21-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-19-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-17-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-32-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-33-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-31-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-27-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-15-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-25-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-7-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-9-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-11-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-2-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-13-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/1660-3-0x0000000000220000-0x0000000000275000-memory.dmp

          Filesize

          340KB

        • memory/2460-75-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2460-88-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-73-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2460-100-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-96-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-94-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-92-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-90-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-86-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-84-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-82-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-80-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-99-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-78-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-77-0x0000000000140000-0x0000000000195000-memory.dmp

          Filesize

          340KB

        • memory/2460-74-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2460-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2460-166-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2460-70-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2460-68-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2460-251-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB