b8610155ca07903d431160950f72eb23450f0793d6268cdf83d20d18e1b6d306

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe
Size

41KB
MD5

a84d4871bc54d3bc8f528ca389f2fff0
SHA1

2e33710cf23d7e1dd5234b2b035005c7c1e455f2
SHA256

b8610155ca07903d431160950f72eb23450f0793d6268cdf83d20d18e1b6d306
SHA512

68af763702e3ca1934e632d4d12c28536fc780821b5783897b39990b60948de1d85eb3db8fd7a407f0fe921636818f81a0fc5f26cbb19147d63b5ac518fd67d2
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2700 services.exe

pid	process
2700	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4164-1-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/2700-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2700-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2700-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2700-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2700-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-35-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp441B.tmp	upx
behavioral2/memory/2700-92-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-91-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/4164-236-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-237-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-240-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-241-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2700-243-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-247-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-248-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-304-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-305-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-306-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-307-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4164-436-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/2700-437-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe
File created	C:\Windows\java.exe	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe

description	pid	process	target process
PID 4164 wrote to memory of 2700	4164	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe	services.exe
PID 4164 wrote to memory of 2700	4164	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe	services.exe
PID 4164 wrote to memory of 2700	4164	a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a84d4871bc54d3bc8f528ca389f2fff0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\results[3].htm
Filesize
1KB

MD5
35a826c9d92a048812533924ecc2d036

SHA1
cc2d0c7849ea5f36532958d31a823e95de787d93

SHA256
0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea

SHA512
fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\search[9].htm
Filesize
123KB

MD5
7be34a16a11f06586aa153c8038121b2

SHA1
9ba1920577ad1442cf53b61bdce82a7f2527eef6

SHA256
ce608e8c9562b918353197d76924a21f8acf12bf96897f347d72546ab97d8db9

SHA512
832719d471e64df953e30d24f630b12422b80d0d2956d6926c09795564b9bca22db01f7b2f25d2a256b015e74b01f6ef6b7ffca15bd946e23fdfea16f4ebc894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search9KZEIT3R.htm
Filesize
150KB

MD5
7b89bcb82688d8e01f68c3048cda4527

SHA1
5c406b157492376f8da6bd09253828963acdc6f6

SHA256
8e8953deb273f19e8f364f972736c64946ce33e64bd6d8c6be4d33f06860e0a7

SHA512
55e23d0ac0276ab79b08aabfce03f912f1c1f6da7f59b442efb298447606e2bc4ccec9a6d39c2f792aa0220e8e6cf5eaa85f908e1c348b2b04df899dabeb4f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[3].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[4].htm
Filesize
126KB

MD5
d14cde4e1158106448e2a732aca5002d

SHA1
88739fcfdcde69b29f7af045565e67961ec16a81

SHA256
93ac3106735ecc87f981cd1d2cc800da2330146b76ec58cdebe9cd29fd5207ca

SHA512
649c1e6d54623593982ef8dd7a18bd75342042893ef312b6cf796d4db2f5ebf7bbe8e75c3e76cd3ce1af4a39c979097abd588db9a62810ec51f2bcc11b381ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[6].htm
Filesize
117KB

MD5
137f92a667322f9f6dc00e8d4998a710

SHA1
296c05f8e01a277758d16d5b7bf0f9ae9f05934a

SHA256
9ccdb07f5b4639dbb9340872fe11042a395d639b35790f098a47aa2f3b62c4c5

SHA512
58fa1301a386ce291b6255c320f1869f5eb0ec18b159df71bf20c93bba2ae42fc4930f6358bce742800eef5c0ff40bb51909b765650bbff3d4de956da503beb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[8].htm
Filesize
150KB

MD5
84915115ddf99ef274d03820bf25cef0

SHA1
582dbcfae6715052743882ec3c242a25589ade11

SHA256
064292de2dbd47ea370984234af424c15a738e772f44c94a593d65fc52a6322a

SHA512
1bcf21c07211fd34a40798c82df36b01acdcef6f0f6da50211b06dd0318fa305067007d9b0355aea1dcece4819c4d4f7abcfc2e5552d9c0a8b5ee0fde6396ca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\JUBQ07OQ.htm
Filesize
185KB

MD5
3f3d235a9162dabba344aee0f7fd25af

SHA1
5988e1d9a53ab0cc72ca5120db2cc39a68c79401

SHA256
46020d324d9311679b93d50c4bc0409a12385457926dba5680e729d44050a6cc

SHA512
5cb72c320e7610e6ffafc90047515fb124f0d202a8e39c498e2304b90dd6f591a93d20a3d86e97e4abee5b973cda5bb381ac5188197fb07992269ee0f34ad7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\results[3].htm
Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[2].htm
Filesize
159KB

MD5
a649102e64c57ed4c90eed697bd7e20d

SHA1
714c0d107831504f513802a81cc1184d06d1ca53

SHA256
00f5189c636d37e8792494aea2e1002cd179eb714f85285ecc70f3315b8a5edd

SHA512
ed895f1802ef5fc19242ae9f0bf88ede0ead8f3e3be9a60432e40b5a981921ad5dd2869d8cc0ada83c0444e2b26500d3ce28123149baa1dcb801fd4dc43cbe68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[9].htm
Filesize
121KB

MD5
c2bfbf4e55d73c90da23dd2d54d8d40f

SHA1
d9129a0807c98e756c2a419c7c544c18f2c9a3fa

SHA256
3ea2362d232ab0a21b95f19d317073126236c36ea6d82ae1921df56251e3dc90

SHA512
fd95b6072e3f2d09f805b51b6712b5431f6e5809bef7221625802de015208568171319c97bb09d9afcf2354bd6fdf3613f6c44c38fdd03d04b3e88525b37d865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\default[2].htm
Filesize
312B

MD5
5431b34b55fc2e8dfe8e2e977e26e6b5

SHA1
87cf8feeb854e523871271b6f5634576de3e7c40

SHA256
3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432

SHA512
6f309dd924ba012486bcf0e3bafe64899007893ea9863b6f4e5428384ad23d9942c74d17c42a5cf9922a0e0fd8d61c287a2288a945a775586125d53376b9325c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\default[4].htm
Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\searchGVTLGF8T.htm
Filesize
160KB

MD5
2bbbf0c9af8ba27b13440d772e5c4c0b

SHA1
f90ab8010615cb0ad954dec6ed38153aef7bc60a

SHA256
8a844da1b2950f57c4e017849610ff88b57233b3e0ab44c03c18768088850b58

SHA512
b6a5601b771fe47ba12d177b2760e4440e2d3898686fdc2ede4aa6d0b497cbb6f5e5648545bf7ad3a144941a726ed918cd0dfa0b13a7fa103939e0e5fab4e5a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\searchJDCF1TTB.htm
Filesize
130KB

MD5
03eafa25b020f23e613d7d0642d2fa67

SHA1
23aa30ee54ac77076bc119ae2085db3041699b56

SHA256
064353b43f8ba6627240da8f413470ccbfb3192a6bac0f0cba46e5709a0ae536

SHA512
53805d227a3a30a7152ce96edb38a8bc24c74bcfa7c59625326de4c43c18affb150878db2523fa71c584cf40678946df1412cbbf1eb7bc1c15e6bdf5d24b6be9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp441B.tmp
Filesize
41KB

MD5
9645ff95497f12d2993d937cffea83ec

SHA1
3ca35212bac95b909c27402aeb7989b8caafc09c

SHA256
f58f867fdda61be42089bd0e938b5a179c114960cec0e3cbf8d98d105145e4dd

SHA512
e9ece95ee941112f10e7af7d7714838e879a70aefc484b000570c0f7aa16ec85b1abdfb7a6ac09d0c0b5e63dd5bbd1cff0b73e568ed22ee22472dac2432b62a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
ac0d2d75d85873c17e1d03901c399261

SHA1
c0b30e8ff8d2592182d94c74079595a6531dee41

SHA256
80b1c6e1b801c9eec5bb867a2372b6e8aec2e0b6f1f6e4ebef930cc4f2a37d46

SHA512
4fe3461e6e7c9e57aab8e793df099308047e950aef67ee7464a70f4946e826743730bb5c793ed22b31a539a37bf5960f59baa21dda10e1896607a2d32d3095c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
b1947bc787122c576f2e0cae3b8af595

SHA1
03458716c1478dfc54b717e8b01b74635e119200

SHA256
adbbe2610f4851f34bbedf2f6f6bb5169f4d2d75bb933c4eabaa8e8e5252f70a

SHA512
f7340be6e45e25c9a61053c02d7b0cbbd622c39847404e9d538c325de574fc7180648a0de0458bcdff2767a4b0e472958bf318ffa9e104053da6542f770324d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
fd815a2b7dcf0062cc3a13bae4a572cd

SHA1
9a5fa049954dc6dad412a43a53990b77824f9561

SHA256
d25e638f9f387b7f1bfb5906c6e53f36b75ece51cd60848a0c25a5511ee3aab8

SHA512
2596b345bd080096f6bb3dda0c951d21b9501941fd689548056f759707f2b95a7b41f4837d048c3048bde2002cad2eb1b4e18cac6a04595731e03544b47c0606

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
160B

MD5
93d851dddfdab3fd999ead3e0390e861

SHA1
1a3c2d0989abc54c335281ea12c95d0d73f836f7

SHA256
f4732e1641a797aaef5ef05a6865aed2954266aaa887200dde96bbcbeff4f7bc

SHA512
f428fda981c34c68b2b551e29f46789eacd914379751070064eb7c23934b550b80af72cd943af07b4c8472e26758c41710558d09e3361c5d92c8a5e4721bd833

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2700-307-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-437-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-241-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-243-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-248-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-305-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-237-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-92-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2700-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4164-35-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-91-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-1-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-436-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-306-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-304-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-236-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-247-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4164-240-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download