msdtcuiu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
784377d840fb04a31ad6daa5a9f77a90_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
784377d840fb04a31ad6daa5a9f77a90_NeikiAnalytics.exe
-
Size
380KB
-
MD5
784377d840fb04a31ad6daa5a9f77a90
-
SHA1
59adac63b220a760a1f669ebda6bec215708d885
-
SHA256
397de8bd1b936546e44258c2f349f945fd205120f8cd7c32520901ccc8dca720
-
SHA512
61839611c3fd681509676c7161d783ef28ffc87424dc1d49cca85ec50f9ed2be981aa8409102c7bbb746173ab4c3f925fa2c4b3e010822183bfd659099181d14
-
SSDEEP
6144:grLUGWbAEH0Ho72DeBQ2mh4H4zDRbKER8YYzjZjCtpK31reHFnqgxSMFTV9yelw8:grLUGWbAEH0HI2DeBQ2A4H4zDdKO8YYO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 784377d840fb04a31ad6daa5a9f77a90_NeikiAnalytics.exe
Files
-
784377d840fb04a31ad6daa5a9f77a90_NeikiAnalytics.exe.dll regsvr32 windows:10 windows x64 arch:x64
9d32834b11a0aa1df5a941c85c7a7e3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
oleaut32
SysAllocString
SysStringLen
VariantClear
OleCreatePropertyFrame
SysFreeString
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CreateStreamOnHGlobal
CoGetObjectContext
StringFromGUID2
CoCreateInstance
CoTaskMemFree
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalAlloc
LocalFree
GlobalFree
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError
dnsapi
DnsValidateName_W
api-ms-win-core-file-l1-1-0
FindNextFileW
FindFirstFileW
SetFileAttributesW
GetFullPathNameW
CreateFileW
GetFileAttributesW
CreateDirectoryW
GetDriveTypeW
DeleteFileW
FindClose
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
LoadStringW
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW
GetModuleFileNameA
LoadResource
GetModuleHandleW
FindResourceExW
FreeResource
LoadLibraryExW
LoadLibraryExA
LoadStringA
DisableThreadLibraryCalls
LockResource
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
FindResourceW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA
api-ms-win-core-registry-l1-1-0
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExA
RegSetValueExA
RegQueryValueExW
RegOpenKeyExW
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
CreateProcessW
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
TlsFree
GetCurrentThread
OpenThreadToken
TlsAlloc
GetCurrentProcessId
SetThreadToken
TlsGetValue
GetCurrentThreadId
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-synch-l1-1-0
ReleaseSemaphore
OpenMutexW
ReleaseMutex
SetEvent
ResetEvent
InitializeCriticalSectionAndSpinCount
CreateEventA
ReleaseSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
CreateEventW
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
CreateSemaphoreExW
CreateMutexExW
CreateMutexW
OpenSemaphoreW
InitializeCriticalSection
WaitForSingleObjectEx
AcquireSRWLockShared
AcquireSRWLockExclusive
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenSCManagerW
OpenServiceW
api-ms-win-core-memory-l1-1-0
CreateFileMappingW
VirtualFree
VirtualAlloc
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
api-ms-win-core-sysinfo-l1-1-0
GetComputerNameExW
GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetSystemDirectoryA
GetSystemWindowsDirectoryA
GetLocalTime
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
api-ms-win-core-heap-obsolete-l1-1-0
GlobalSize
GlobalUnlock
GlobalLock
api-ms-win-core-sidebyside-l1-1-0
FindActCtxSectionStringW
QueryActCtxW
CreateActCtxW
DeactivateActCtx
ActivateActCtx
ole32
OleRegGetMiscStatus
CreateDataAdviseHolder
OleRegGetUserType
CreateOleAdviseHolder
OleRegEnumVerbs
ReleaseStgMedium
advapi32
RegConnectRegistryW
SetNamedSecurityInfoW
LookupPrivilegeValueA
EnableTrace
FlushTraceW
ReportEventW
QueryTraceW
DeregisterEventSource
RegisterEventSourceW
kernel32
MoveFileW
UnregisterWaitEx
QueueUserWorkItem
user32
MessageBoxW
LoadBitmapW
GetDC
SendDlgItemMessageW
EndDialog
DestroyMenu
ReleaseDC
GetMonitorInfoW
MonitorFromPoint
GetWindowLongW
SetWindowLongW
DialogBoxParamW
TrackPopupMenu
CheckMenuItem
EnableMenuItem
GetSubMenu
GetDlgItem
GetParent
SendMessageW
SetWindowLongPtrW
SetWindowTextW
RegisterClipboardFormatW
SetDlgItemTextW
EnableWindow
GetWindowTextLengthW
GetWindowTextW
SetDlgItemInt
GetDlgItemInt
RegisterWindowMessageW
SetFocus
DestroyWindow
ShowWindow
EndPaint
GetClientRect
BeginPaint
GetFocus
IsChild
UnionRect
PtInRect
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
DestroyAcceleratorTable
IsWindow
GetKeyState
InvalidateRect
CreateDialogParamW
MoveWindow
DefWindowProcW
GetWindowLongPtrW
CreateWindowExW
CallWindowProcW
PostMessageW
LoadImageW
GetWindowRect
MapWindowPoints
GetActiveWindow
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
LoadMenuW
GetCursorPos
gdi32
DeleteDC
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileW
CreateRectRgnIndirect
DeleteObject
SetViewportOrgEx
RestoreDC
msvcrt
__C_specific_handler
_purecall
_wcsicmp
_vsnwprintf
wcschr
memcpy_s
memset
memcmp
_vsnprintf_s
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_local_unwind
_ultow
wcscpy_s
_waccess
_wfopen
strchr
??3@YAXPEAX@Z
mbstowcs
fwprintf
fprintf
??_V@YAXPEAX@Z
fclose
??0exception@@QEAA@AEBV0@@Z
memmove_s
fflush
_vsnprintf
_wtoi
fopen
iswdigit
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
_stricmp
memmove
_XcptFilter
_amsg_exit
free
_initterm
?terminate@@YAXXZ
wcstok
??1type_info@@UEAA@XZ
__CxxFrameHandler4
_lock
_unlock
__dllonexit
_onexit
wcsrchr
_wcsnicmp
wcscmp
atl
ord32
ord43
ord44
ord27
ord26
ord31
ord45
ord23
ord21
ord16
ord15
ord18
ord57
ord30
msdtcprx
CreateLocalTmInstance
ord27
CreateTmInstanceForRemoteAdmin
CreateLegacyTmInstance
ord25
mtxclu
MtxCluIsClusterPresentExW
MtxCluGetDefaultClusterResourceNonAdmin
MtxCluVerifyLogPathIsValidCSV
MtxCluGetResourceIdStringFromName
MtxCluGetDefaultClusterResource
MtxCluSetDefaultClusterResource
FailedClusterAPIToEventLog
MtxCluCreateClusterTmInstance
MtxCluGetActiveClusterNode
MtxCluGetNameFromResourceIdString
MtxCluGetNameFromResourceIdStringNonAdmin
MtxCluEnumerateDtcResources
MtxCluVerifyLogPathInDependantDiskResource
MtxCluGetDTCVirtualServerNameW
clusapi
OpenClusterResourceEx
OpenClusterEx
CloseCluster
ClusterResourceControl
GetNodeClusterState
ClusterResourceTypeGetEnumCount
ClusterResourceTypeEnum
GetClusterResourceState
ClusterResourceTypeCloseEnum
ClusterResourceTypeOpenEnum
ClusterCloseEnum
ClusterOpenEnum
CloseClusterResource
shell32
SHGetFileInfoW
ord165
SHGetPathFromIDListW
SHBrowseForFolderW
resutils
ResUtilFindSzProperty
ntdll
RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-processthreads-l1-1-1
FlushInstructionCache
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InterlockedPopEntrySList
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
AdjustTokenPrivileges
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
AllocateAndInitializeSid
GetSidLengthRequired
CopySid
GetTokenInformation
IsWellKnownSid
GetSecurityDescriptorSacl
FreeSid
CheckTokenMembership
GetLengthSid
api-ms-win-service-management-l2-1-0
QueryServiceConfigW
api-ms-win-security-lsalookup-l2-1-0
LookupAccountNameW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
CompareStringW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetCommandLineA
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-eventing-classicprovider-l1-1-0
UnregisterTraceGuids
api-ms-win-eventing-controller-l1-1-0
StartTraceW
StopTraceW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-security-lsapolicy-l1-1-0
LsaClose
Exports
Exports
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DtcPerfClose
DtcPerfCollect
DtcPerfOpen
PerfDllRegisterServer
Sections
.text Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ