424720d9e78e876f887a4faba6a75f7461eefab10859aaf115f753720be04a13

General

Target

9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
Size

629KB
MD5

9c8c668359645d17b6c988a5403f0050
SHA1

f67a00579f544da6112092be22e8b4b35970c1de
SHA256

424720d9e78e876f887a4faba6a75f7461eefab10859aaf115f753720be04a13
SHA512

a4af0a049aeacbe80e9d07cbb2947b24308b67bc31d77b768d7608a77adf93c0e06be6c2a629732a7021653be3cbb4ddea5495ede80e866324ed537808ce1f19
SSDEEP

12288:brMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9VPRREq3Ltt:1ZyCA8CBmn+RrNj9ay5IPRREmX

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe

pid process

4408 9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe

pid	process
4408	9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe	upx
behavioral2/memory/4408-5-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/4408-8-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\RCX5BF5.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\gIntegrator.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\gaccicons.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX5D78.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\gelevation_service.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjarsigner.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\gchrome.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\RCX5BC4.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\gaccicons.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\gOSE.EXE	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\dotnet\gdotnet.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5C35.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\g7zG.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\gIntegratedOffice.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX5B02.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\gVSTOInstaller.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\gUninstall.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjavadoc.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\RCX5D45.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\gcreatedump.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gjavadoc.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gjavah.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjava-rmi.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5C74.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\gResizeWait.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\gextcheck.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gidlj.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX5B33.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\RCX5BE4.tmp	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\gcrashreporter.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gjavap.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\gFLTLDR.EXE	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\gdotnet.ico	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe

description ioc process

File opened for modification C:\Windows\bfsvc.exe 9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1540 4408 WerFault.exe 9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe

description	ioc	process
File opened for modification	C:\Windows\bfsvc.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe

pid	pid_target	process	target process
1540	4408	WerFault.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe

description	pid	process	target process
PID 4884 wrote to memory of 4408	4884	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe
PID 4884 wrote to memory of 4408	4884	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe
PID 4884 wrote to memory of 4408	4884	9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe	9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe

C:\Users\Admin\AppData\Local\Temp\9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c8c668359645d17b6c988a5403f0050_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe
C:\Users\Admin\AppData\Local\Temp\9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe
2⤵
- Executes dropped EXE
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 264
3⤵
- Program crash
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4408 -ip 4408
1⤵
PID:2404

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7zFM.exe
Filesize
629KB

MD5
9c8c668359645d17b6c988a5403f0050

SHA1
f67a00579f544da6112092be22e8b4b35970c1de

SHA256
424720d9e78e876f887a4faba6a75f7461eefab10859aaf115f753720be04a13

SHA512
a4af0a049aeacbe80e9d07cbb2947b24308b67bc31d77b768d7608a77adf93c0e06be6c2a629732a7021653be3cbb4ddea5495ede80e866324ed537808ce1f19

Download Submit
C:\Program Files\Java\jdk-1.8\bin\gjavaws.ico
Filesize
4KB

MD5
38b41d03e9dfcbbd08210c5f0b50ba71

SHA1
2fbfde75ce9fe8423d8e7720bf7408cedcb57a70

SHA256
611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5

SHA512
ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\gIntegratedOffice.ico
Filesize
4KB

MD5
3ea9bcbc01e1a652de5a6fc291a66d1a

SHA1
aee490d53ee201879dff37503a0796c77642a792

SHA256
a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c

SHA512
7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\gmisc.ico
Filesize
4KB

MD5
fc27f73816c9f640d800cdc1c9294751

SHA1
e6c3d8835d1de4e9606e5588e741cd1be27398f6

SHA256
3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05

SHA512
9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c8c668359645d17b6c988a5403f0050_NeikiAnalyticsmgr.exe
Filesize
105KB

MD5
48327ee6dec8ae239eff2ffb30403028

SHA1
45e4e5014944e1229c49f9e7ad4d0925d93a55bb

SHA256
aa3d7c9d4576ca5b9848306ec5f1e3331d1227c9d1e20d2ea80ba611084bad6a

SHA512
1c20199e6726237c47f9bd958e9a135778280a8c0e0a86f8bed05f98d199e1502bb54605b036c6a2a54fbc5c48407afaab1e08730e84f1a18d56f5ad3cb89316

Download Submit
memory/4408-6-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/4408-5-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4408-8-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4884-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4884-7-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4884-254-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4884-256-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads