Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 01:46

General

  • Target

    986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe

  • Size

    131KB

  • MD5

    986ec6e70492f9f97c911f7840301210

  • SHA1

    4003643a5bb06b8b840df51bf57ddb8f12885b59

  • SHA256

    e31469db6210a1270ffd7e1f0f53776f6b3e30b8a7f839010b77754f2c10f1d8

  • SHA512

    a24917d5465d1f841c4bb2ac3559665b00c881c1c6ddc91a79f74489a87ecd9e787cbc02ab012d29948386f606400b3102e9f5d9d70d3ccd3818190eb80142d7

  • SSDEEP

    3072:yEboFVlGAvwsgbpvYfMTc72L10fPsout6nn:BBzsgbpvnTcyOPsoS6nn

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2728
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:688
    • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:788
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

    Filesize

    132KB

    MD5

    f0d4d2cd02a2dc511273710400401225

    SHA1

    a05f2c855225b624dc5a3a32c5d0576bc43386c4

    SHA256

    2570bb2b18d9bb9f1032cef04637203718c45b9fe20e788c7632bc86fd4a435f

    SHA512

    b4d993b888379b8891a850ae35688ecade48c7151d1c8cbb169150cda2e9c8c35dbb45174c901adf5c8bf29037a132bbfcf3bdd69d152525c9df17afe5796b37

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

    Filesize

    131KB

    MD5

    7315f09e63adabf25fb1e8a499a57a81

    SHA1

    134a68783f6b2e7106dc936b103969c5c0855db4

    SHA256

    afe5e8bbb3b9dbf4b9aeb5959360a99aa0c39114c48b912c1f7484798a8ba248

    SHA512

    f4451d9b87d5fa4734db37e4ec9944d51a18df33693a5406f565e14347fc61fa876f36f37b9e7478c2fd31f1f7fab500fb898ff4dec9bf68cf165378a42e8f33

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\FKC.WYA

    Filesize

    108KB

    MD5

    f697e0c5c1d34f00d1700d6d549d4811

    SHA1

    f50a99377a7419185fc269bb4d12954ca42b8589

    SHA256

    1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

    SHA512

    d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFmain.ini

    Filesize

    711B

    MD5

    5b85700764c7f8ed2db3d99aba090ff3

    SHA1

    89521db8d1abb29e082628efdd23c547fa54ef44

    SHA256

    ade5e3636e8684f5845c18666a04a6b22d7a0f2631ea268a1aec910857c42e24

    SHA512

    00600e12dc1067eba53760eedfc4f408e88053a87462d55f01478887a9b4095138d471cc186684f0c14f4c2559da978e0ef3f78341910ecf1ca8caac9f67a642

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

    Filesize

    22B

    MD5

    a4ef93de80711124d4b7e080ccf42edb

    SHA1

    f4530f5e6d362781fa6dfa4982d25f3ad15dbf99

    SHA256

    9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24

    SHA512

    707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

    Filesize

    87B

    MD5

    fd1a69df1d37e13075e79ebcb161f096

    SHA1

    771fcf5423f8e0bd63f9771e88a8063ff9e3384d

    SHA256

    c0d736114a433a5c9c93fc8b03727d55c674f68ec6ee431b36514200c4d51329

    SHA512

    04acdce07c62cb85e82542a49aaed2cfb2b980e2c0035754cd0eda3e70e469ab9e5b30f1c62550e22c3ef92c7aff971bd38f8154edf9aad9424abacd207ce8f9

  • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

    Filesize

    131KB

    MD5

    0031d28219f905f778fe3c2daf89ef1b

    SHA1

    df7c79a1e660d744d6cb38287a90edf3cca105dc

    SHA256

    4a4461327b2d811d8535e40abf90a20298e0a54b9b9b066abf031fcd1830fcca

    SHA512

    a5f64edc270f500314e1e1f305bf7e458a3050a7bb52ef5273d9accd896fb80e4573a9357b1757f565c93a187e742470502380fce88650e96bfbdb00e9e2492e

  • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

    Filesize

    131KB

    MD5

    a4e97b7eaaef667d7a4d579fcbcbfa89

    SHA1

    451364eec93692017f7f51660bef9139463f635b

    SHA256

    943821f1d65be27c01835b14cda839f1a5f39ff4eb3e28432137b02f44deb4a7

    SHA512

    7b46acb6a5a5a6d7ee306518fb3ee280b305e6485cdcd05787ffcd8f38466cfa879a4f404d9a387e8d81d73e7606e35b29d0563c2e0cd825828cfca31e49c053

  • \Windows\SysWOW64\kernel64.dll

    Filesize

    1.1MB

    MD5

    9b98d47916ead4f69ef51b56b0c2323c

    SHA1

    290a80b4ded0efc0fd00816f373fcea81a521330

    SHA256

    96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

    SHA512

    68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

  • memory/2544-80-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-100-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-250-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2544-166-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2544-77-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-88-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-82-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-84-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-90-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-92-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-68-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2544-70-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2544-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2544-76-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2544-94-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-74-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2544-73-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2544-78-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-86-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-96-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/2544-98-0x0000000000110000-0x0000000000165000-memory.dmp

    Filesize

    340KB

  • memory/3008-19-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-27-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-23-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-11-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-31-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-32-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-2-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-33-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-15-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-21-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-29-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-5-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-7-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-9-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-25-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-13-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-3-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB

  • memory/3008-17-0x00000000003A0000-0x00000000003F5000-memory.dmp

    Filesize

    340KB