Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 01:46

General

  • Target

    986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe

  • Size

    131KB

  • MD5

    986ec6e70492f9f97c911f7840301210

  • SHA1

    4003643a5bb06b8b840df51bf57ddb8f12885b59

  • SHA256

    e31469db6210a1270ffd7e1f0f53776f6b3e30b8a7f839010b77754f2c10f1d8

  • SHA512

    a24917d5465d1f841c4bb2ac3559665b00c881c1c6ddc91a79f74489a87ecd9e787cbc02ab012d29948386f606400b3102e9f5d9d70d3ccd3818190eb80142d7

  • SSDEEP

    3072:yEboFVlGAvwsgbpvYfMTc72L10fPsout6nn:BBzsgbpvnTcyOPsoS6nn

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 23 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\986ec6e70492f9f97c911f7840301210_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
      2⤵
        PID:3076
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
        2⤵
        • Deletes itself
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1104
    • C:\Windows\system32\cmd.exe
      cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg
        "C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
          3⤵
            PID:4532
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530435D474A422F565840 0
            3⤵
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of AdjustPrivilegeToken
            PID:2304

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\1D11D1B123.IMD

        Filesize

        132KB

        MD5

        90be7200e28d83d9e1ec151f34956999

        SHA1

        b49426fa21da572110249568d42bbbead1952f49

        SHA256

        f862e42dfe696913495d53c3631aeba6b4193fd2216d454ac0e68fc6f7a058f5

        SHA512

        16582f4a811823807f02e6d86d7d11591b2940350a1dea66cf7c4b959a45078c2f526d93843cb1189e69ed053c130bfda5bdb4e53f48cd67194b229e63683621

      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIF.jpg

        Filesize

        131KB

        MD5

        9447e9b39545944dced82b229de151ad

        SHA1

        ec4290ab4d16cb85b1d4d027b51259f115758441

        SHA256

        18ecdf800a0117d467438f1ed4a55d76b0946ded2c490abcd55a5983147f791d

        SHA512

        62c3f3ea77a20d52ddce3f6032dc8f4fa67ac2aeb16233b3287d7218ccf211e70b54d5a2caba59ac39eac260050f88b5c1b8b61e95e1ab709d8c4e46c4066c2c

      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\KVEIFss1.ini

        Filesize

        22B

        MD5

        a4ef93de80711124d4b7e080ccf42edb

        SHA1

        f4530f5e6d362781fa6dfa4982d25f3ad15dbf99

        SHA256

        9a09d2a2b23760cbc02ab362728b30783f943d90beebbdbd03c4e8b288492d24

        SHA512

        707c5a1a84a1cd490e3e0109c30b32724a69d27021653265bbd838065458e1eea20b470f145612f9ea5486711c47a59dcb515f9625829e63689a89af75901fa2

      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1B\ok.txt

        Filesize

        87B

        MD5

        fd1a69df1d37e13075e79ebcb161f096

        SHA1

        771fcf5423f8e0bd63f9771e88a8063ff9e3384d

        SHA256

        c0d736114a433a5c9c93fc8b03727d55c674f68ec6ee431b36514200c4d51329

        SHA512

        04acdce07c62cb85e82542a49aaed2cfb2b980e2c0035754cd0eda3e70e469ab9e5b30f1c62550e22c3ef92c7aff971bd38f8154edf9aad9424abacd207ce8f9

      • C:\Program Files\Common Files\Microsoft\1D11D1B\KVEIF.jpg

        Filesize

        131KB

        MD5

        0511418665159520f5b765c1a992e6bb

        SHA1

        e2dced15b7e04778e6b5071d09b77f4845fbb6cf

        SHA256

        622836767d22d1dc31444106daedfe35e9b8922ff3625af5246874e0334e8021

        SHA512

        990717c47ae278611eecb488035ed1c246a2aedc337fbe629c98a17963c1ac64fb51f75fab4e9377fafba6ceeea8953ddccbf13fbb9c1a5f492ba5b6d3b14897

      • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

        Filesize

        1KB

        MD5

        de5e42d8779e73d0e9ad0e26baf98044

        SHA1

        0c6346fc1f5b1158cad3606759c4c08fa0c90262

        SHA256

        75865a57ae5285034d324963b62b1028e260fc8a7cb8b5af70ff553ed8967644

        SHA512

        045547935db37cad73297abcba843839253d2f5965f12880d72ada98e646e7d2b90c696b02d2099804b2dd36afcc57b497ad7c20e713d0e61a1766791f911052

      • C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1B\KVEIFmain.ini

        Filesize

        1KB

        MD5

        aaa9c44ef01ba2530203794669f188b3

        SHA1

        35952a3e9ca0736f54af1314d2dd60d4a724d790

        SHA256

        ee99c06a1b698b51e96b167902f05821290aeb604ed9b22d758adfd492326069

        SHA512

        1fa0f686ae43ca0384511a8e225738fcd16c0aa0ef51cb6d420360d2233b8dec8840e9f19ad580aff34789e8e38ea2a406383210b4b32fa201c29e49dc8aaf0f

      • C:\Windows\SysWOW64\kernel64.dll

        Filesize

        625KB

        MD5

        eccf28d7e5ccec24119b88edd160f8f4

        SHA1

        98509587a3d37a20b56b50fd57f823a1691a034c

        SHA256

        820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

        SHA512

        c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

      • C:\Windows\Web\606C646364636479.tmp

        Filesize

        108KB

        MD5

        f697e0c5c1d34f00d1700d6d549d4811

        SHA1

        f50a99377a7419185fc269bb4d12954ca42b8589

        SHA256

        1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

        SHA512

        d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

      • memory/1104-111-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-113-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-131-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-245-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/1104-125-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-104-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-117-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-121-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-127-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-107-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-109-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-129-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-119-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-97-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/1104-100-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/1104-103-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/1104-101-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/1104-105-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-115-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/1104-123-0x0000000002CA0000-0x0000000002CF5000-memory.dmp

        Filesize

        340KB

      • memory/2304-197-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/2304-246-0x0000000000400000-0x000000000042D000-memory.dmp

        Filesize

        180KB

      • memory/4900-17-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-27-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-25-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-21-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-19-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-13-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-15-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-32-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-2-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-10-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-3-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-6-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-29-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-33-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-31-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-7-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-23-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB

      • memory/4900-11-0x0000000002170000-0x00000000021C5000-memory.dmp

        Filesize

        340KB