Overview

overview

10

Static

static

7

8441d19b30...cs.exe

windows7-x64

7

8441d19b30...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 20:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8441d19b301dcb9093dca1257ae01090_NeikiAnalytics.exe
  • Size 29KB
  • Sample240613-y8rh8azard
  • SHA256 1df820f21d9700d7711e098e398b50251db8d4fcf0d48a1fe06fd36bfab1be9f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
googlemicrosoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected google phishing page
    phishinggoogle
  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8441d19b301dcb9093dca1257ae01090_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8441d19b301dcb9093dca1257ae01090_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4380

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        XH69DVHV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\XH69DVHV.htm
        • Size 185KB
        • SHA256 787c474bfb14db1634715b0ab6cea130b64bbfdfd251acdb660dd233fe9083b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\default[1].htm
        • Size 312B
        • SHA256 3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
        • MD5 SHA1 SHA512
        Submit Download

        results[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\results[7].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search2CZM3W5J.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\search2CZM3W5J.htm
        • Size 150KB
        • SHA256 c5cfe030e11eb1419ab2dd9707104593067c835607453435f29d95f90de68bb8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search3BZBZZW0.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\search3BZBZZW0.htm
        • Size 111KB
        • SHA256 7053083781a419174345601b89216336b7d39fb25d2997e6aeb0f96ef3a39021
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\search[4].htm
        • Size 137KB
        • SHA256 c946e09ffcefa7c32e9c574241e0747b1a5909f701cb13d6ec2484ce1869a558
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KUIDTOJI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\KUIDTOJI.htm
        • Size 185KB
        • SHA256 7fa147aba6b997ca4c118d9891e857bf8c4ff23dddaa8a1e690778bef74d781d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\default[3].htm
        • Size 315B
        • SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
        • MD5 SHA1 SHA512
        Submit Download

        results7NU1NCKD.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\results7NU1NCKD.htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\results[5].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        searchPAVAMIYV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\searchPAVAMIYV.htm
        • Size 130KB
        • SHA256 eeb7ac1c2a4064d9dd7b506a6bc826e9178e5ff2be1bb22e56c2e86c4b7814f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZEBE2XEB.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\searchZEBE2XEB.htm
        • Size 141KB
        • SHA256 f13f04830cf7332f47e31ddaac249809d0a36876f65d3f98a77f9b820ba45bae
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\search[6].htm
        • Size 166KB
        • SHA256 f693de98b36ebe70e0ee68676bc758417eb56380af91f28efc10c2f155b667a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\default[1].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        resultsSVI6EMHI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\resultsSVI6EMHI.htm
        • Size 1KB
        • SHA256 82a58c2ca69ad8e52efd5e0533150f12430f560ee56d885237b8e486be743b90
        • MD5 SHA1 SHA512
        Submit Download

        searchNKKXK328.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\searchNKKXK328.htm
        • Size 150KB
        • SHA256 a2444cc2e6bfcd9c7b999d939090332a194296482dbfd37356a16d7707b75b4c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchO10EU3GF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\searchO10EU3GF.htm
        • Size 164KB
        • SHA256 0b75c16338ded865ab99fd1eb1b082a6e904f9f807f04ea1fbd1a4bc90943718
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\search[7].htm
        • Size 129KB
        • SHA256 13cb35e80c13b4b7f8b49efceb0bbfe4598708a001c8af2908c56f0b58795332
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\search[8].htm
        • Size 117KB
        • SHA256 f760a282a3ba1e27ced088f668869df17cf3b0e044de071d242edd2100640257
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchEPQINH2N.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\searchEPQINH2N.htm
        • Size 138KB
        • SHA256 c947c230526f8473fa2564d0e8c83ca3d6ce4a1613cd5902e428f7295a7a1d9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchOIAFM2VO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\searchOIAFM2VO.htm
        • Size 115KB
        • SHA256 e1b292225c6d05f03d0bd6c71b71955b05c04fbcff52d57cc033a18ac736a2b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQZWONPPL.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\searchQZWONPPL.htm
        • Size 150KB
        • SHA256 87b0209efc751840fec09fa13dc463534176e408defc5d3c4373ae2b51aca0f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchUWLZ6OX4.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\searchUWLZ6OX4.htm
        • Size 135KB
        • SHA256 cdd71cc6099fa801a991e7c367f4a281ceca63bbdd880e06e8b7e6d894c86818
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\search[2].htm
        • Size 181KB
        • SHA256 322b514569b0c4d97d7230ee88cfb432f969ac5aadf7783a78d383f2886463d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\search[3].htm
        • Size 129KB
        • SHA256 d21d51323b788da9db3362ceb00d425ea02c14e70c01816668dc87b70b5fbbaa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\search[7].htm
        • Size 189KB
        • SHA256 56ddafa5d48abb059ce092fc9553e7c283d63a0966ed3c341ba1099e9c077edb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp1C9D.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp1C9D.tmp
        • Size 29KB
        • SHA256 6dd2b54d41455a2615b16d6e8bc4de23ba970fa2beadc9c080d2de5b7df67449
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 5af865e00b7931ac77929c9f3d9aa8c38c7c5a8675a992145c7935ed08e075ae
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 faad3396fddcd953b92dfcc188e38be75a095e985e68dd67d072816d09902d9d
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 db3549d6d683647f7f7951f92da5a30436a9b16b48bd1d10e62201bda67f6b55
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2344-304-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-399-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-843-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-205-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-35-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-604-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-713-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-311-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2344-30-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4380-400-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-605-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-714-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-209-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-844-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-310-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-305-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4380-312-0x0000000000400000-0x0000000000408000-memory.dmp
        Download