Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 01:19

General

  • Target

    2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe

  • Size

    126KB

  • MD5

    2269b25cfac36601d7883f1c3536ec20

  • SHA1

    0b730ecc2a691f344e30e1e89a72e1897e28f50c

  • SHA256

    5be1459cb89a7426a91707678653b5a593bd53b5eed0a6f4817668971af3847d

  • SHA512

    80f169e6ef35a7f0c5407c54fb9521a3cfb8320960232a38334ddc191b00d7eac0d22e7e47749ca393b9be532524ca8a479fb476d28e495a9ed876d226849fdd

  • SSDEEP

    3072:4EboFVlGAvwsgbpvYfMTc72L10fPsout6S:HBzsgbpvnTcyOPsoS6S

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2269b25cfac36601d7883f1c3536ec20_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:232
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2228
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1920

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

          Filesize

          127KB

          MD5

          05018897e2ad295b6324b9bbd71bcd35

          SHA1

          ffc28d6e23b63f322c0f1c24e521a9bb65dba330

          SHA256

          2d43c455ccfb47f96fcc1e03b57a9e039fe9f1e1631991dd0851541a4c45922c

          SHA512

          0a88eae844008aceb1e47669a3b1d8d6fa674cefe02e2a0a435921c37bce0d5254c254bed3820409710c782f2821e362c222803aa5ba1d077ceda4e3c7b7ea2c

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg

          Filesize

          126KB

          MD5

          bd93621194a0aaa76285066cf0d856b3

          SHA1

          449ce542c3c2f8d93e91d926d0f17b4fc6498e05

          SHA256

          cba88ab4a618c3444cb1a9bef70b9f6219df049a0b0d98a3c58ee58a1240f38f

          SHA512

          9370cea2ba96fd29932f0274b630e3e0c9f310cd0312ed7d26d62275420158dbccfc51d0ba2a9e3d8a333a66269cfef0d92ae887a4a9a8f4ad3eacea6c537807

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

          Filesize

          22B

          MD5

          2056c975629bc764596c2ba68ab3c6da

          SHA1

          35e3da93ce68d24c687e8c972f8fa2b903be75b8

          SHA256

          8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7

          SHA512

          c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

          Filesize

          87B

          MD5

          1ee836a55c14e46ea1e0a75c52875d90

          SHA1

          ce5feca843f7c3efd0997e99ff41b2e182a66566

          SHA256

          4d8d08b98d3c324868b3459a807d64572666c114d84651daede007b0d561abee

          SHA512

          51369c1a734f0d3cdf32d2d6424214f4e04bb12d3cf703e4dd97176b8aab51bb57c237776efb2b4e1d6c98caa7cc1accec4461de8a791a90c3d3e5cccae69c8b

        • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

          Filesize

          126KB

          MD5

          8c94e87782606997f08b1031644f7c14

          SHA1

          a3e1419bf62dbac557fbf0cbb5ea81a5a390736c

          SHA256

          7499a7b41eed3bffd46ffb61722173cb496f933a40a41f35dcca68025c7c97b3

          SHA512

          6190ae598d0fd0fd46f947aea649a26e60a4c1527694cc09b9a3095b0407ca82704a94e336d4f506fbcb984ad72d4e6b053a5ac59920a159f35fa586415e669a

        • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

          Filesize

          1KB

          MD5

          c804c651a3bc36e599bcecba92b03100

          SHA1

          eeeda9bf66c4dbf38ca0c517be40ffa49aee177c

          SHA256

          2d3c236ef650dcb0c36355ce8754d74a5aa1622a1aa0a3dfaa313cd6bf25e267

          SHA512

          b6cc86f17f459bb4ecabc503b1ae52e77da76d4f616d267bad153b4f2e8d94d449cc1d9b6a50a49fa859d71678fbf8ad698770070c618523ef71b385444c5cd2

        • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

          Filesize

          1KB

          MD5

          83699f7219191e054ca6784721d4f935

          SHA1

          b19428f7b4c0c5d9bdae93d57ddfab46121cd2d3

          SHA256

          36d818e09cc931c79a4feea7691e347f01d0143d31e8d949a10b0662a4a151d1

          SHA512

          1ee037e881d63a83a61a1354ab3299c8e3674a5a5adb7551b5db74104bd8a884d41b262265f7c9fa0c7d417004cd2e7efe75c625c0062d0711812f7244989237

        • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

          Filesize

          1KB

          MD5

          6d65868e4682271c711206ae15310e7f

          SHA1

          7455c6c26bb070fd8a1fe97a9578466b1896d254

          SHA256

          4857526a301f7e80d18e4976fb12be47b5a21430492d842d01446193e8d5f1ba

          SHA512

          d134d2c5879b3700e9fc7c6b4ff7719c2dfc9fdd8224f298a13d23da46c76c2d546ceb9db4d832d37f728cf9dfaefc2138cdd9adb4ab036a4b75e630f57b5746

        • C:\Windows\SysWOW64\kernel64.dll

          Filesize

          625KB

          MD5

          eccf28d7e5ccec24119b88edd160f8f4

          SHA1

          98509587a3d37a20b56b50fd57f823a1691a034c

          SHA256

          820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

          SHA512

          c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

        • C:\Windows\Web\606C646364636479.tmp

          Filesize

          108KB

          MD5

          f697e0c5c1d34f00d1700d6d549d4811

          SHA1

          f50a99377a7419185fc269bb4d12954ca42b8589

          SHA256

          1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

          SHA512

          d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

        • memory/232-23-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-13-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-22-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-15-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-31-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-19-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-17-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-9-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-5-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-27-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-3-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-7-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-2-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-12-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-32-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-25-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-33-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/232-29-0x0000000000590000-0x00000000005E5000-memory.dmp

          Filesize

          340KB

        • memory/1920-196-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/1920-245-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2228-99-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2228-130-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-128-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-126-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-122-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-120-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-118-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-116-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-114-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-108-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-112-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-124-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-107-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-104-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-103-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-110-0x0000000003150000-0x00000000031A5000-memory.dmp

          Filesize

          340KB

        • memory/2228-100-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2228-102-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2228-244-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

        • memory/2228-96-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB