Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 09:10

General

  • Target

    316b2d8bd7c08ef7be664446c3d6fc50_NeikiAnalytics.exe

  • Size

    29KB

  • MD5

    316b2d8bd7c08ef7be664446c3d6fc50

  • SHA1

    2a04a8f06cae68cf8fbe9a4fc722d92b19e54414

  • SHA256

    cc512faff7c2ec567aa636bbe41dd667fba39454403eb47bf3d59870a28be2d7

  • SHA512

    9b513e5e0bf0a9cb1b6b309b1d16111f7dfa20a7a04f4b9c844ac1ec4738092622f77dbb1b1d20366edebca10e7e274099e62878dbb45acada63edd407ba1820

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/s:AEwVs+0jNDY1qi/qU

Malware Config

Signatures

  • Detected microsoft outlook phishing page
  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\316b2d8bd7c08ef7be664446c3d6fc50_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\316b2d8bd7c08ef7be664446c3d6fc50_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4196

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\WG5QEAUN.htm
    Filesize

    175KB

    MD5

    3b617708954579db22b2587e026dc7da

    SHA1

    9b957b6a14fb64c002c8687e257a157ef81b86bf

    SHA256

    71d083fe626f29d371362e5b3e1cd9d2ea7b454c2fb971af0c18f86b6cc0b88d

    SHA512

    a0b91e0ab88880dde920ce22030d7305d78fe459c92531aa90eccc55271cf8177046d83a0119b644d5735e2fa300a6a6633b7485c0e76a6b727ce378320858f3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\default[5].htm
    Filesize

    312B

    MD5

    c15952329e9cd008b41f979b6c76b9a2

    SHA1

    53c58cc742b5a0273df8d01ba2779a979c1ff967

    SHA256

    5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

    SHA512

    6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\results[3].htm
    Filesize

    1KB

    MD5

    211da0345fa466aa8dbde830c83c19f8

    SHA1

    779ece4d54a099274b2814a9780000ba49af1b81

    SHA256

    aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

    SHA512

    37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchD74903ZZ.htm
    Filesize

    104KB

    MD5

    7d2ca5ae8d1cbf87d38c999995e85434

    SHA1

    08a31a714e2ff819ba7e96c174d5995206449824

    SHA256

    e3350a9b3a7a82850d2d335642a67668b84fe5f43d4871e8b4b6092c8b1be6bf

    SHA512

    2bca0a23267aa8c905a01c3a0baede0a31c2820c7b6d22d33242a893cac9442bef3ce96c9a633799e1ed1cf81c4d294d338bc45102287a27aa1a2dde72059a1e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchMNN6SE3C.htm
    Filesize

    130KB

    MD5

    9774007a8ab8b32d749c8f5ef30d7cad

    SHA1

    0f796132adb63fa5f6603281815ccb9390df64c0

    SHA256

    757c27905a6349ad0c5abc43f487c3031ed64440e5a0435e7f2204bbc4eb4bc9

    SHA512

    785c06bf8cd9e0e37f45984802da2770fed980f035468f6d3ab1cee2f8714ea759af7b7bbd8a3144ad7ab7fac5a83e0fc9b89a54e96d63357bbf89bfaebe907a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchTR6F7KKI.htm
    Filesize

    140KB

    MD5

    4af432829c94e32ac6eb2597fea3c369

    SHA1

    6c5cf2c9a0738c406a4f03da3e87522cb6344a38

    SHA256

    3f0d2b0cd6bd64bd6bafff3be1c7714dffb804d8f039db6147634455e946f7e3

    SHA512

    954d4f2dc5da5a9203e6522d4358dfda799dd849143ae1cea2715ef10207f2cff8cd382dc4464270941d0b031eb629962ab06d6aeac96267c7417142f58a954f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[4].htm
    Filesize

    121KB

    MD5

    973ddb87aace15464f391d4859617763

    SHA1

    7dd4d79796e1a7a45a76a420cfd8ade70678d52d

    SHA256

    a6c95e2baacbc87374c2417979af3f2bb2aeef8a6d37c4eeb183dfbad46dbcc7

    SHA512

    f520c25044045f7cd6cbb1a003a18b216e8c6d38cfdbcc1e299c1ff2d6fd351593613a3304527fa3bc8d08361f1b23b74b1d4af5ff0c91fb05a944b613d2e318

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search7KX5MSOP.htm
    Filesize

    142KB

    MD5

    c1780a4c46010294b7a1de2d7c59f8c4

    SHA1

    01259340243c393377c74e87f98a7bb677d44a0c

    SHA256

    92c7c3ee281132a7ffdb38609ff85b2c4bbbae9eb17a291c5013359e44c3b7b0

    SHA512

    dcce0360ac3580e8e9b5c0e1fa95a2b511dd3c8c45dc9ce6c5a823ac065dd423ed0d899e5e6ac87339e66e4dbd9c378c601120daa08de430954494d89ceeaf6f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchQZ2FNL4M.htm
    Filesize

    160KB

    MD5

    afc99e9e039a6a8578dbbd688593cfee

    SHA1

    4a6fe64c5b8339df886de79359cf5a08f99ed6b6

    SHA256

    4d63c3ad7fce16a3ed59210cfbf465b2d8d5d0ef9e00820999d9b91693026a3c

    SHA512

    9259d913e64fa6ed70b47dea8cbb95811a6491a27dcfc2f8980d0f91eff359c757df7a51e1aa3299b190f3a6171f65140da5dd497c2ae86fae094170e266f48b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchXN0KYXSV.htm
    Filesize

    125KB

    MD5

    5de391d9b0365f6ff84e2803bb8de6af

    SHA1

    1ea728bdd735d53100f6ae3fea8d7a1ec77e46ec

    SHA256

    b5979ca5e8b29ca8c022933a235a261b80831ad54c5c475c2cd3b1d28256ef88

    SHA512

    180dcfe7a6248ac5a930b804c6e97bd3e0cfa41a477aa19f858a7163095b9693c0791d37cb2e736b62f4604fe242d0fd7258c8f97f2193998a5d62d325be872a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchZYO0336A.htm
    Filesize

    137KB

    MD5

    e5add6398f41f185fdade56e7e9dbd36

    SHA1

    d2c808527603e4a87c10cee8829cd3ba7a5bef93

    SHA256

    c3c1100502ad69fabdd2223607452add7f39a2a4f731473a8d05a39bf109970b

    SHA512

    d6d1d9f994de05bd8137cb0e95e4cbb4c488b208a708eee09fca3c4141bf8257bb74cd156383650b803f65b706b3e47a5f783664c9a8df2a3a63ce6e8f21112c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search[2].htm
    Filesize

    115KB

    MD5

    a2e26181c1bfdf8153e270d68d96ebe3

    SHA1

    d3365637ae2b23910b33bfcf72cf7a17f00e9a98

    SHA256

    1e45a345a847b40db68976cfd612be939d4907a24376ae8b5b7a52078d908612

    SHA512

    f849876bc1077af4ed026bca1b86cb3e201da6a977e98ea0d9c7057e101c9d22523c6397f656c77f8ad1e0aa246406bde10ccf2ad05d0bc7a5bc102497a0231d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\results[5].htm
    Filesize

    1KB

    MD5

    ee4aed56584bf64c08683064e422b722

    SHA1

    45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

    SHA256

    a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

    SHA512

    058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\searchKABZEZ40.htm
    Filesize

    138KB

    MD5

    82b912e1d1c39cb60a82120232088f81

    SHA1

    c9a3da62f906e72ff795fe41f02e2ada2524e4cb

    SHA256

    817ae788bffa7946896c2abd4056f1599b429569c34b12b3572b7e12faac2434

    SHA512

    cc1190e6b919102785a9bc3953f7dfc3f882b28433072eb9d1b9c434d313235dd828c9a7d22f5d671a2d84745cf975721462e0f4d01b8c1d6bd27c7213e98379

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\searchW15TNVZF.htm
    Filesize

    123KB

    MD5

    22e23021fa95b4b9d17a1a2db889d793

    SHA1

    ec12da8e5033e82131e5cd755f69de40b99facea

    SHA256

    3783b4a8082b352397ed10b07029aaa0cf3acd2b47562deb88d9571705fbd136

    SHA512

    be4d53516d69f366f3bccb809a1d92e01398597dd2085c198d3ef0d63fc5e2c3ca9bc9049764ce1b0304f6f85edf8f43ea8506bdb029ab484e62821691621062

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[10].htm
    Filesize

    118KB

    MD5

    38f94f0ab5ebfa9a24bebc0bb19d6d31

    SHA1

    8763452588ae6951be84d11ee65a4bf44ba567fa

    SHA256

    57c3f0efc3a43a18db656cd4b16b112c57edef0ed3f5b3f9e5f8ff8e83edd46d

    SHA512

    2e0ac50d69123a473b0d3986bf650e8574a73b93bba19343b191e3788752ce60227c94bb1baa28a7348bf4f38ded917c44a1a2c1c9a906882452d6556ebca933

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[3].htm
    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[7].htm
    Filesize

    159KB

    MD5

    9a8b7705b4e8acb1efd7ab71a8a0db1c

    SHA1

    a5bcca5120161b9ba40e4beb4afe19462c93a814

    SHA256

    72bc75637660a8d21663c493b2f00fc062d264a9316f39cbc9d2eb9772345753

    SHA512

    c41464f9cf1c6f33bdb2aa924166a566ee0435e1b9d2bf3d7aede9700ee323643dc4fe496dcfaac312669f08f25a0d254aab2e7961c897735eea5f9760a50cab

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[8].htm
    Filesize

    115KB

    MD5

    8768188548711795673bd8c9989e5f24

    SHA1

    397ada6bd7ef91b7004d44591eb0fcb06ea8f09c

    SHA256

    fc00d28ff35a9caea484850905b3815f2438e39a59ff4df9b63856b35df5afd8

    SHA512

    11d6a6239f6f571ff3332925609d4a2670f0eae3ba88cd444a4febc972a48641c9ee28d8602c95b8ebfea040d4df394892fa2cdac420c10dc2e68449e91d174f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\searchYHLZL52A.htm
    Filesize

    121KB

    MD5

    a41aa6a92767db01b3d15a3ddb25c4aa

    SHA1

    95ca82db678da33ea7012364954ea58224ac128c

    SHA256

    55f70c9c6b5e540a85e8bc5a569164cd1eb7f6db614688e5e39e1121893e4311

    SHA512

    12b17e8898a9836ea4098dff106efd342b809c46429a466b88e4bdb28952ef064e17bc4b93e1c8e72a1d4f65079bd296ac9b42183b94d84f8dfc45387198d528

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\search[1].htm
    Filesize

    146KB

    MD5

    701ed93538351912233b379ea0de0417

    SHA1

    25dced8a4e8bb4b223c63ee0666648bc1d9a34e5

    SHA256

    dfe02ae7d49822a5468e9ef60b6890fa740b54eaba9d72fd144ddc0a9c5121c5

    SHA512

    7b3400ae340eaf70cc8eb3823d241c6afab00e2fe54db825b13040cc99aad3adb34e6bad4778b1b7db96cb43087bed0cdc0d8147163839ec73c0f491f81ea0b5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\search[7].htm
    Filesize

    137KB

    MD5

    4c832289901895d402c55106984db186

    SHA1

    9ce9589e15538d261ff395d33a7fd6db5c24f5d0

    SHA256

    f227db4412988b595d87a0fe83a3e6812377d9532e43593d6ddfe4cc4ff72926

    SHA512

    0308c977cd768d15e54b2cfbe4f621652f85ffd202f50357e055fadc485f390da16759a6de872dbab8287b694c20464aac507d7953c6bec4356b21d29218cad2

  • C:\Users\Admin\AppData\Local\Temp\tmp2C6C.tmp
    Filesize

    29KB

    MD5

    0a5b2c1bebea4c85faa412edad0ab0a9

    SHA1

    e327ca40fbdac7cd1b9c653c4f94c4523fc58899

    SHA256

    52fa09b040f3e775db228563196f4c8c7e0019620514bf2c4ca225416fa534ff

    SHA512

    9674aabde2124fc52d48480b9be5f7fc5f696109add5dbfeb23bc449449f54e7d6723f64a9cc77328f7a681f92bd8bbc5766d6da9aa600fc16e52aec18667852

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    352B

    MD5

    9c07c5c7bb60c55b308edd04dd03a4ae

    SHA1

    5c5c83c8778c0f3502d78bcdcc92d839733cccea

    SHA256

    49c27dbb1bd9cc415d2d690afe254ba6333a736c1e9548d18baff443eb06f72b

    SHA512

    3ed989ffded5f5291e14e55283eb560a519e51b1748ea93345e2dc301621befdbd0419cb1be7d0d69b3dcbd6d6e6c1205ed65dde873c572d6314766a65419817

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    352B

    MD5

    3cd26aa3cb9a1ae72953dedfc20f0608

    SHA1

    5328296dd1d2af3482a432f71afe29ff4ec80688

    SHA256

    968c4dd4c4e9829d90c5a5d7f47e779b5875bdd6603a14752ac033a98d64a080

    SHA512

    7ba1d8232cc596b4cf7cb47978da39e42413f589904f4c86ca1ad60d05449979819232fa8660e794076f4f308a82cd8bd807a95b0b275c0c306d5aec5627b200

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    352B

    MD5

    3747c506c91e6dfa43334dbe8ed16eaf

    SHA1

    1352b4710e1a2c0cdbd0bfcbec37b3aad67ae89f

    SHA256

    a6dc00f3f8106e35ba47b48c29a4e3f5230f201f5192816c7b3cae98dd19efd5

    SHA512

    fe2f8aa1d623fff82668cb410bcda72b610a7aab492c744ba91e6b41097df0c15f2709bdb377251fa1ad880c10136b5da25b43706735c13c0c537577fe06f46c

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    352B

    MD5

    1de2412c79c37b6d4d9607ccad55d4d6

    SHA1

    6d45a6304b1a81187b0b60e75f92a67da2617d3e

    SHA256

    1e41419ee376c39cd70916bd79e471615a5f963373995ec99adb3a9b10b4fc88

    SHA512

    d1b5a4d7430c99d5421d1b02397a2b25c455ce27a7749659beb998102657560ec8455244c1c672f86f09500ff5874f90277273495ddf576313db560afce3d2e7

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Windows\services.exe
    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2876-13-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-281-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-671-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-187-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-0-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-375-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-617-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-288-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-35-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-513-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/2876-30-0x0000000000500000-0x0000000000510200-memory.dmp
    Filesize

    64KB

  • memory/4196-19-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-36-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-26-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-31-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-514-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-282-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-14-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-24-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-287-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-376-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-618-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-7-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-289-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-188-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/4196-672-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB