Overview

overview

10

Static

static

7

9ae0a1b508...cs.exe

windows7-x64

7

9ae0a1b508...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 02:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
  • Size 41KB
  • Sample240614-ctep8awamn
  • SHA256 a903565a2e93c0d356419e0c222417b62e5c7296529a98f7073a094a13a1dbb5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9ae0a1b508ca599c5dda97c85c720ad0_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4488

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PN003FR0.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\PN003FR0.htm
        • Size 185KB
        • SHA256 11d1f000f98d45d31fbb217e0ccb125a92c0afc10eda9edd9e2028535e3832c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\results[1].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchL1HNHIGN.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\searchL1HNHIGN.htm
        • Size 136KB
        • SHA256 4adc49b36ad709e88f160b5e2eec96aacff304cb87c2db47aea2d2b93ea10778
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYAVAGQ1Q.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\searchYAVAGQ1Q.htm
        • Size 113KB
        • SHA256 57f5b62aee189dc38f525320bcf6b51ac1de006fbd5c6d009484b4b003f6ba12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8Z1Z4637\search[4].htm
        • Size 121KB
        • SHA256 c3532014d200d55b5afe9d787fc1ebf8551be6d39317485fa99b8bab29e58bf2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\results[2].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search70ITDDDM.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\search70ITDDDM.htm
        • Size 122KB
        • SHA256 146c672be24c4bd57b1f6ab9c70b4312266773176db7e08dd4f421255fb03a62
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchI8TFWEDE.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\searchI8TFWEDE.htm
        • Size 130KB
        • SHA256 53669458a475d1d64a130a0ca9754e09bb70b2507e05ea6e1685c3c37c488b4f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCKU5E0S\search[7].htm
        • Size 129KB
        • SHA256 99f96cc912220ef435383cdae87c31d83d9b54f603c3c4c8d30cd1cce3996b1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\results[3].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchK4K5ME7W.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\searchK4K5ME7W.htm
        • Size 150KB
        • SHA256 4bc0ddd93eadbf764afc4ea1d896278457bb5673a3d72ccbdf202ab8601e606b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchOJELOEYG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\searchOJELOEYG.htm
        • Size 159KB
        • SHA256 57cca731fd3943259d914f051592bb366b7890f37245b81cd8db534747fea30a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchSOOHO12I.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\searchSOOHO12I.htm
        • Size 113KB
        • SHA256 3f000e47901b6e5573da3a4d5360aea1b60d9c65c456a0429c221d4b767e7c6a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchWAX5WCNC.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\searchWAX5WCNC.htm
        • Size 195KB
        • SHA256 2f56d18c1eae0bcbe53069d6d5647a111015f42a720a49cac4ed15283335655d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQACG5HD\search[10].htm
        • Size 119KB
        • SHA256 8544f9bda40dc52454b8fd1dde3a90c42e37491c551f05bde58f3022c339c305
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\results[5].htm
        • Size 1KB
        • SHA256 3c0cf785ae4898fab36c8e6e6d1ff44a1b980db0216539cc895157efe273da2d
        • MD5 SHA1 SHA512
        Submit Download

        searchIB305CD7.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\searchIB305CD7.htm
        • Size 122KB
        • SHA256 62a4276b212aef853029110b72118278f21404fab8edbe94846598cf763604b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchO26JRN7J.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\searchO26JRN7J.htm
        • Size 170KB
        • SHA256 7c42b709b46709c42165ec8ca0ab4aa5377269fc704cb1a68e6fcfd39d8a3359
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\search[10].htm
        • Size 181KB
        • SHA256 6933b31abbca0858ff92a5a5606e798fddfa123bb3ef52b3aed97099405faa1c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\search[2].htm
        • Size 129KB
        • SHA256 5c70e4657ae730b00bdc4ee1a661f6dfeb34c1938e243a3afb3e40723e07d7ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZRDQ3WBJ\search[5].htm
        • Size 150KB
        • SHA256 a92a82012cc8d8eee2a8d08905f04b2759d90fbcbf0e625ef82554231f0f25e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp52AF.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp52AF.tmp
        • Size 41KB
        • SHA256 5cb2f9db54d3ff3c217b7d67ed15599a0cf29e092e3f9fce5ce238c5ab81bc95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 af47709ec25418507783c2a4ac0bdb68316facc5049c2052ed5d37a379c11f41
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 b4682f7cd71ba396e5397c2f3b2bcb574e6d8ca8c3aaa90f456dd425d124df1e
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 008f49a2b3893ba7386e520ba893be3e21c119736cec04e40e722963c4ac0db3
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 160B
        • SHA256 3994712eaa3ec950803f8b6f22497d986cd75d1b8c7c9eee0c995ea0d99e81be
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4488-501-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-314-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-363-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-203-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-309-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-631-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-307-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-38-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4488-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4764-306-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-630-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-37-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-202-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-500-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-313-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/4764-362-0x0000000000500000-0x0000000000510200-memory.dmp
        Download