V����eG�k�RLVdO���0����� ��XC�ӗ��с�.e��_4"r��P�X�1�/(�0eZɴ�t���Y�8V��~���l9��8��^��A�NjE�-����Z��`�~����bFF�C%{5P|N��j]�9H�Vt�ە^�%�_I9y�8<�w��Rm,��*�H�ٸЃ�$Tev������/3�Ȯ �c8�]���Щ} �����a��d�3@�m�GY6ISa���-����YH��=d��Ŵ�n;�M�c�����l�1<[�G�_����U|���i�M�u�hv!W:B�B��/�y�� 3s�/�t��t"���J�����sf8%N�I4[�Gx�eX�tșc!�;HR���ЩH�� [�(xE$��:��Ψ�(�����%�:N#bw�:�����;��_���A��CS&ѝWYn7�%���w��e���h6{��]�� �QƱ֔�0��|��n�m�b4�)�b�nR��7(��; �Ub=N�'D�l]X�r))cUr7�����,k}c�;��G���w��/X�+![%����u�CX��I��i�s�T���qS4#_ŋ0��\�˯������hA�m!�q������>X���#{��?#8&��#С��'�r�l��骤86u�V�� u�t��冚+Z�� �_� �Z����,�.�NyS�y`�����"��u�!&���`�u�v`P��5J�j�����߂������X�1�j�xTY��{�B���$�)�}3��K�0P�z7w�s���#P�ej��k��ӗ�i��^%a�C�v�r�E}z��J��3uel�X*��|fa��*�x�ֺ�qs�����GM�:g��q���M҇f�3��+�""�gd�1f��M���Ƿ�D?��+��\�����"�|�3u����J�a�{�}�f�1g�2<R���4'�p�\+��� Нϗja$�69�x]�)��N_g�_�s[^�����r�P)QVL��L܊�S��'�V.�)|��� ]�����x�諽��쨊����/ \=^R5��P6���7R3fS)�f��T!t��BO��cW�-�Sm���g�]^�,�Ӫ)`�<�� O�8d�+a�o�9����V��u�<1A_��'�������OZ� )P}�l����̓��sk�/,�\��B����7��Q��Ϯ\?$��3t�>��l�� Hax�M3q�"��&c�>�}��%7���oNr7/�&������q��.��D'��S�8�&����ߙ�O�Z6���/�l��tKF%j5�.���:����+4�.*7yi�ˎ&홴�p���m`��D�8��ѳ�0�EJ� ?�+�� �"X��n�/�1�^�f�D�`ӏ�S��Led7yX�����c�L�S/z�~w�+wSFVL��؏�~\�U������b��K�>19���������f��Z�C�C���n����zr�*3��!��̌�Ew��G�@�n+��Gq��FAp 5d�W�]t?i]�Z#0�PY�tI��~��3bcN;;7�ew������`��(H�gwn��W�^�jΚ��u�m����35�����Z�L��O��}xg%�<_����Ti)�}�,�!�nS� &GW��z�{M���兴 |����3�Hf�Gi���!�IP�<�f�iB z,=�0t�nr�@QL~F4��*J$4V��c,��^�� 8��*<�����,� �ǬI�G�ft/~��FE��u��������@V�E�e9���Kr,��|�8���pD,1�"��[!��~¸�2�����(�Hy4ߨJA�X��Ϙ������o���(N�Z�2C�N��������U&W�Քe�)� ]�������%_ϵ"�A���f�j����j'j:�ӜlUE&KP~�\ �#|�c�F�`Ƽ���Y�e�j篤�c�o�nc�\c�v��6l�v�-$�uZ�ƀ��>���1⓲���+Z�*o}�*V����h훧���U|�"��I�1紶�p>+Q�!���e�4�g�M����gRW�7��M��~���3���v�5Y��� �/|�4'wi+������ Q,�����}k�ɜ�y�_��F7���訾�G����S&+9���-�t(��saK��z��vq�� �<u��2`��Y� e�8�)�;&�m�z���l�!7���� x����|}Oe�ۈ9z8쉳�:�Q u���S&��������� 7߶�2���%��h��Y+�6~��;����-����[Q��`�ϡ5v8/i�QX�� ��e�U�oȟ�I+��)Ty|5�u`���c�32i�q8��C�e�Kd�T��2�_��֝2*�.�dA� /��i�(��O���}�(#f�.{p9nA�QsP8a�O��6k���P6$�Os���D���A�9�S&���І��s��2�H������z���u]�D�z���3�8b��Ɇ�B3>�Q�G~7�R|ُ�$��q��K�p��Z+�#2_}N�;�^�1H�w�%(s ���:�ox�=�I>$��$h��ң���f4�U'��V2�����ڍ�����A�ym��$�s`m�HQ�Ĭ�8ݎ�e��4��E'v�C��c@<��q��bI�X�7r�;B�� m���S��1��Y��V+�ͩS���b �"[Wn����څ�(��Ύ�gx�F˪КD<�6v�Ѝ�y����i]�U/A�Pt])����st��&s��m��\�`3#���p�7�7��\'�������B5s��g�fD���s߈�łU2����# �������s�ݻ�R����A@ԃ��f!Q�����$(�k��z�U���V�T0s�>��l/� ���-}Jb��?{��1�Y"�Y��P4s�}�պ���:��>�c���@e�G������'�I�h ۡE���*4%����iu�u�X81,�a����4ʒJ�V �}�i���P��~���W7��g�. 8G���r�)�O�8G���~S�ˠ2���r������ �y�������fZ��Vv~��'���
Behavioral task
behavioral1
Sample
39867cccf6363b19c06781128687c970_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
39867cccf6363b19c06781128687c970_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
39867cccf6363b19c06781128687c970_NeikiAnalytics.exe
-
Size
5.2MB
-
MD5
39867cccf6363b19c06781128687c970
-
SHA1
a1e8e4debf902b768210146cd2e82534e87e2f35
-
SHA256
b4fc8150065dc61d4a5ffea7a73857bd1888e8d4c43c5a6a0a4a9b0dcaf6e0c5
-
SHA512
bf4c87f47184bfbdaa2e83eba192c44a19aa925cd17e0f70bf0ded1d2083b3e9fc180111dd55389ed6d465b37c551667a92996ff5ac734875b9e376fc4439ef0
-
SSDEEP
98304:AhFRMBx154yzTISoF6/5fL/lLc9Qz3t9P4heiBDRfi:ArRK7kSoF6/5rVcyzwheiBNK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39867cccf6363b19c06781128687c970_NeikiAnalytics.exe
Files
-
39867cccf6363b19c06781128687c970_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
775694f4dedf2179f9b01bc220438f1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryFullProcessImageNameW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameW
msvcp140
_Query_perf_frequency
normaliz
IdnToAscii
wldap32
ord41
crypt32
CertCloseStore
ws2_32
select
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-stdio-l1-1-0
_pclose
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-environment-l1-1-0
getenv
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ