94c50d6983ceab97d38f680663f973d0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
94c50d6983ceab97d38f680663f973d0_NeikiAnalytics.exe
Size 864KB
Sample240614-a4vs3ssapj
SHA256 9e02859372db14279322c872265184c2a290e9a717502298e30f82b20e9d9338
MD5 94c50d6983ceab97d38f680663f973d0
SHA1 bd8f43a31780313b009209b2c01e3ccfae63d78c
SHA512 68555391e0e7279d406f153b7917bce20a9ea6bee063ba6d93d62f98a379cc3529e37a099ea1b683ee78a0f68000571ea272bc71c8f4595cb49449c6cb8a68dd
SSDEEP 12288:hYXJkWHSEbECPUVpyNj3C/Ei9OQSt6uk3zO61zOQJjN6atJ6bVgwtZJz:h02WHpPUMj3C/Uvw3B8atQVpZJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94c50d6983ceab97d38f680663f973d0_NeikiAnalytics.exe

File Explorer

94c50d6983ceab97d38f680663f973d0_NeikiAnalytics.exe

.exe 864KB

94c50d6983ceab97d38f680663f973d0_NeikiAnalytics.exe

IMPHASH c29a8b4e64755be19f08b918f93a11c7
SHA256 9e02859372db14279322c872265184c2a290e9a717502298e30f82b20e9d9338
MD5 94c50d6983ceab97d38f680663f973d0
SHA1 bd8f43a31780313b009209b2c01e3ccfae63d78c
SHA512 68555391e0e7279d406f153b7917bce20a9ea6bee063ba6d93d62f98a379cc3529e37a099ea1b683ee78a0f68000571ea272bc71c8f4595cb49449c6cb8a68dd
SSDEEP 12288:hYXJkWHSEbECPUVpyNj3C/Ei9OQSt6uk3zO61zOQJjN6atJ6bVgwtZJz:h02WHpPUMj3C/Uvw3B8atQVpZJ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

243824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

TieringEngineService.pdb

msvcrt

wcscat_s __CxxFrameHandler3 _snwprintf_s wcsncmp _vsnwprintf realloc swprintf_s _onexit __dllonexit _unlock _lock ??1type_info@@UEAA@XZ ?terminate@@YAXXZ _commode _fmode _wcmdln _initterm __setusermatherr _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit _XcptFilter wcscpy_s memset _callnewh malloc free _purecall __C_specific_handler _CxxThrowException

ntdll

RtlSetBits RtlInitializeBitMap RtlCreateSystemVolumeInformationFolder NtQueryInformationFile NtSetInformationFile RtlCopyUnicodeString NtFsControlFile NtWaitForSingleObject NtOpenFile RtlGetThreadErrorMode RtlSetThreadErrorMode RtlNumberOfClearBits RtlStringFromGUID WinSqmEndSession WinSqmStartSession NtClose RtlNtStatusToDosError RtlGUIDFromString RtlCompareUnicodeString RtlInitUnicodeString RtlCompareMemory RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WinSqmAddToStreamEx

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids GetTraceEnableFlags RegisterTraceGuidsW TraceMessage

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter GetLastError RaiseException SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoUninitialize CoTaskMemFree CoMarshalInterface CoInitializeEx CoRevokeClassObject CreateStreamOnHGlobal CoCreateInstance CoSuspendClassObjects CoUnmarshalInterface CoTaskMemAlloc CoResumeClassObjects CoReleaseMarshalData CoCreateGuid CoRegisterClassObject

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection ReleaseSRWLockShared AcquireSRWLockExclusive InitializeSRWLock WaitForSingleObject ReleaseSRWLockExclusive AcquireSRWLockShared SetEvent CreateEventW ResetEvent InitializeCriticalSection

api-ms-win-eventing-provider-l1-1-0

EventRegister EventWrite EventSetInformation EventWriteTransfer EventUnregister

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleHandleExW LoadStringW

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId CreateThread GetCurrentThreadId GetStartupInfoW GetCurrentProcess TerminateProcess OpenProcessToken

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolCleanupGroup WaitForThreadpoolWorkCallbacks CloseThreadpoolCleanupGroupMembers FreeLibraryWhenCallbackReturns CloseThreadpoolWait CloseThreadpool SetThreadpoolWait CreateThreadpoolWait SubmitThreadpoolWork CreateThreadpoolWork SetThreadpoolThreadMinimum WaitForThreadpoolTimerCallbacks SetThreadpoolThreadMaximum WaitForThreadpoolWaitCallbacks CreateThreadpoolCleanupGroup CreateThreadpool

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount GetSystemWindowsDirectoryW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW

api-ms-win-core-file-l1-1-0

FindClose CreateDirectoryW DeleteFileW FindNextFileW FindNextVolumeW GetFileAttributesW FindVolumeClose FindFirstVolumeW FindFirstFileW

api-ms-win-core-registry-l1-1-0

RegGetValueW RegCreateKeyExW RegNotifyChangeKeyValue

api-ms-win-eventing-controller-l1-1-0

ControlTraceW EnableTraceEx2 StartTraceW

api-ms-win-eventing-consumer-l1-1-0

OpenTraceW CloseTrace ProcessTrace

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges PrivilegeCheck

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW

api-ms-win-devices-config-l1-1-1

CM_Register_Notification CM_Unregister_Notification

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

esent

JetOpenTableW JetDeleteTableW JetSetCurrentIndexW JetCreateDatabase2W JetOpenDatabaseW JetAttachDatabase2W JetBeginSessionW JetEndSession JetCloseDatabase JetCloseTable JetInit3W JetTerm2 JetSetSystemParameterW JetCreateInstance2W JetCreateTableColumnIndex2W JetResetSessionContext JetSetSessionContext JetOpenTempTable JetRetrieveColumns JetSetColumns JetPrepareUpdate JetUpdate JetMove JetMakeKey JetSeek JetBeginTransaction JetRetrieveColumn JetDelete JetCommitTransaction JetRollback JetGetColumnInfoW JetComputeStats JetEnableMultiInstanceW JetGetObjectInfoW

clusapi

GetClusterInformation OpenCluster CloseCluster

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

239KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

94c50d6983ceab97d38f680663f973d0_NeikiAnalytics.exe

msvcrt

ntdll

oleaut32

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-kernel32-legacy-l1-1-0

esent

clusapi

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic