Overview

overview

10

Static

static

7

4c9e0bf142...cs.exe

windows7-x64

7

4c9e0bf142...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 23:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4c9e0bf14262353cad5acfe6f517d4d0_NeikiAnalytics.exe
  • Size 41KB
  • Sample240612-3esxeavekh
  • SHA256 234ae2f697aa2c7d96c270f2a94ad68043fc06cba6b4821eed108d90d1ad74f3
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c9e0bf14262353cad5acfe6f517d4d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4c9e0bf14262353cad5acfe6f517d4d0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3944

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        results[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\results[6].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchRM1ST1IO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchRM1ST1IO.htm
        • Size 162KB
        • SHA256 d92f50d0349d911c12e708175e81b668fcc6f5aaeb6046d63dbd203febe1c2a6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[10].htm
        • Size 115KB
        • SHA256 5b1a740867b1daad5d6991cfa53d7059dc9289cd2f1f39af59827f48b5a6c6c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[7].htm
        • Size 130KB
        • SHA256 0806727a98dd45e0fd6271887a05c216463c55a3b132538b88ffb9ff8a2fdc3e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DYFSJKHE.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\DYFSJKHE.htm
        • Size 185KB
        • SHA256 a8d2668f2e4ca52d19df0c9588f377bd1e496f12f16d5de838686cf9bdff3638
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\default[2].htm
        • Size 315B
        • SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
        • MD5 SHA1 SHA512
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\default[3].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchG0YVQU61.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchG0YVQU61.htm
        • Size 121KB
        • SHA256 0acf9fbf805fc1c7a18ea4d543c58e6f9b07abc63678c8411385456ac2497dc8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZEKHOLVF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchZEKHOLVF.htm
        • Size 129KB
        • SHA256 827fe1ce05fa5d5977206ea7b1d6615ba5be7602a0454a6fbcbcd16fc599c0ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search[7].htm
        • Size 129KB
        • SHA256 50065dc17168f3ffb4edbc26a35cf9cd5a26b090180055d857554e1ce70a8531
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search[8].htm
        • Size 118KB
        • SHA256 8dd8ce4f93b5996e3abe80bbb89e6ed055c6390aa995a5a5c2d377585d71f336
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\results[4].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search1JUY03S6.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search1JUY03S6.htm
        • Size 136KB
        • SHA256 365dd30619fb763264b24f1622ae46f044ac24db446116986803fc8ba1c843f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMBGPBJJB.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\searchMBGPBJJB.htm
        • Size 139KB
        • SHA256 2356958291cd9db912f6acba4dcb7c6d93e749b9fefd0e8d48550f95f4014804
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchR9BJ7KC3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\searchR9BJ7KC3.htm
        • Size 147KB
        • SHA256 1a6b02a8c86de58e438da3c33e2acc6a6c3b3c9276482fb5938f10790c5734bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[2].htm
        • Size 136KB
        • SHA256 cd95473f98641020cd270b0bb291308cab18944d6c664ad103511869c6261fb3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[9].htm
        • Size 149KB
        • SHA256 5a4e67e06751681d8fe4ce513083b835ca8c5a2772a2d7462c1f0f5b049a56c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\results[4].htm
        • Size 1KB
        • SHA256 82a58c2ca69ad8e52efd5e0533150f12430f560ee56d885237b8e486be743b90
        • MD5 SHA1 SHA512
        Submit Download

        searchA6KJFZOU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\searchA6KJFZOU.htm
        • Size 136KB
        • SHA256 4e158d9ed46c25c61b99e8f5cb518a0c6ad04dc1234d3a0cf848afe04741ca8b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\search[1].htm
        • Size 133KB
        • SHA256 d7595eb4caf4caa646609ef92f8d32fcaefdbde509f1764ee5dae7ff28e204f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp468C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp468C.tmp
        • Size 41KB
        • SHA256 d0cd333e24c632b76eb1251a1de6f60523d1279efb15a07f89ee3fe6ebe42d9b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 d5031e3958c071020b2613c96946447dd301ce2e6a82a34783ca7ac33ffe3dc4
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 5c07d66863ada4a5b184e38601d27a70496ebf407ed118a6088a209c2e21e6a5
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 cd170876fac910cbd467dbfaf4074fd4d7b7983dfbefc24b6115ed4dc274bc79
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 7e22181ca50ffb8165d85cd79c88df59dac6ebcb06d5d832c83d030f9f37e201
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 0d592851325b3efa5ed3b4cf71130729f7c79b2c64848c18f7ea4ef704a46287
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2916-255-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-259-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-766-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-111-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-497-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-275-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-636-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2916-35-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/3944-112-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-276-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-637-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-498-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-767-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-256-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-260-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3944-262-0x0000000000400000-0x0000000000408000-memory.dmp
        Download