Overview

overview

10

Static

static

7

6975897c1a...cs.exe

windows7-x64

7

6975897c1a...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/06/2024, 08:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6975897c1a913c8a7882b9672e3f8850_NeikiAnalytics.exe
  • Size 29KB
  • Sample240617-j83txsscma
  • SHA256 b560819783b7fa91b8af0ace744037c562dba16697c0b2d53fe1305c239b6e09
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6975897c1a913c8a7882b9672e3f8850_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6975897c1a913c8a7882b9672e3f8850_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2660

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\default[1].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search006QOM5P.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search006QOM5P.htm
        • Size 159KB
        • SHA256 0f319be5da394c8cdee3c4d447ac67e8752c56f33ad182bb853eaec7c5265e97
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchHUKKM0DB.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchHUKKM0DB.htm
        • Size 132KB
        • SHA256 2e329756d7bc3bd52f937d59ad7a64f34c925fc9e7765cc269acf5c34f54470a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[5].htm
        • Size 135KB
        • SHA256 b3f2eebceb43fe88c18be377e731c0b1393c6c79e46b80da6023c3010ebcd6ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[7].htm
        • Size 126KB
        • SHA256 7389ea8ddca1709275bd88ae627a3bcdfc93fd4faaf669c262ed0d25f2e6f357
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\default[3].htm
        • Size 312B
        • SHA256 3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
        • MD5 SHA1 SHA512
        Submit Download

        default[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\default[4].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\results[5].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search0SGB53W2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search0SGB53W2.htm
        • Size 103KB
        • SHA256 02e8f1438fa4bb5a3d772c3105e79b14afc8ed1eaae95df7a62b1ddbba28eb8b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search31QC5G9Z.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search31QC5G9Z.htm
        • Size 163KB
        • SHA256 76d9b318294298723b6b49034ab689b806d82f967c05b5bbfafa6cebd6388c27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchUEQ6ZEXY.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\searchUEQ6ZEXY.htm
        • Size 146KB
        • SHA256 822c19147d19a1f4bfdfbc25b95504a2ed51ace04c1b934f6224595ed348c17c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[2].htm
        • Size 137KB
        • SHA256 55b9454ec881ebffa5ec692a8f28a5b3e4c0468e1d83c4f1de14d4f6294e94fb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[3].htm
        • Size 155KB
        • SHA256 bb41d3adf0bf5fc51c2a36fc0049fe4ca11a3de62741ef7d59af174532428175
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[5].htm
        • Size 138KB
        • SHA256 00b842ed97c6cc2f0a1f9e489092d3ea5c61ad85473f490951b357479b3d6ff5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[8].htm
        • Size 137KB
        • SHA256 331d80b143abea2f88edf9b25547ce563615baf6a1a1e5c709a1d6440670679b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BVRMED2G.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\BVRMED2G.htm
        • Size 185KB
        • SHA256 3c42b0d2d0ff63904ee762f73cd3aea519ca560aa327a0c606ae915b207b6714
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\default[4].htm
        • Size 304B
        • SHA256 a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
        • MD5 SHA1 SHA512
        Submit Download

        results[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\results[8].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        searchEK888ZMP.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\searchEK888ZMP.htm
        • Size 122KB
        • SHA256 91da01373fa18159990ab13479352c9f4fb83f6058f75c01310b8039692fef95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\search[5].htm
        • Size 169KB
        • SHA256 352fc740c0560ff0e712cfe1bc8836fa2155a8cc204e1b1e80da53f785603965
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\default[1].htm
        • Size 305B
        • SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
        • MD5 SHA1 SHA512
        Submit Download

        default[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\default[5].htm
        • Size 311B
        • SHA256 312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15
        • MD5 SHA1 SHA512
        Submit Download

        searchKMWH04GE.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\searchKMWH04GE.htm
        • Size 149KB
        • SHA256 37662fc599eceb48d92774981eee78f08e6cf8c37dc58f6a8cb86ec7162712bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\search[6].htm
        • Size 115KB
        • SHA256 c293d7db89fe85a43c771056c19c9dde797f0ff7c819ab11c32176dffe8a739f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp5011.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp5011.tmp
        • Size 29KB
        • SHA256 073b64e7a4a3e130cbdc1124a41d5e3b020c913bd90fc01e3a3f6fb25912dc61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 6c455524c2564d09c9b2f443c22f9410386badcdf826392795c455977c0bac8f
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 8e6ec2345cf4fcc930c5acc628f0698429e9894244bf37ea8cf4ac31d9f6c44b
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 622d398f1d7ae314ea9897473a9585f1c990f2c290ebdafe9f52b3d98b11cdee
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 352B
        • SHA256 fe6dd301a1d7992db60cea758e8f9692cfa341fe1700191edfe51f0f26107522
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/216-296-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-35-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-396-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-13-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-302-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-883-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-30-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-0-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-721-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-556-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/216-168-0x0000000000500000-0x0000000000510200-memory.dmp
        Download

        memory/2660-557-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-303-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-169-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-723-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-297-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-301-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-884-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-397-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2660-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download