Extracted

• • Target
    315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf_NeikiAnalytics.exe
  • Size 1.5MB
  • SHA256 315e6b61f8da1fa45c7a25789c06045a03105cfbe4fb4eee55e7854ee046cfbf
  • MD5 843781c719ff01cdca931e3c1badfbe0
  • SHA1 6f6f5af54239b1c3d914f01a2ea7aaccbecc2866
  • SHA512 ea9d4ebb05aec01ee3596cd7a5d5eb4b25d69196923fe5f878ce8eda02c07c54795f020967c75984d518339e6af938a8d0f24fcc4743d9294a199a4bc82c2b32
  • SSDEEP 24576:kf+iN57Gtene3ZqNjbw/oVnxYodjKPz/q5a1KnCygexzbq4mxz5vtKiTBp5sbPr:KLXKtene3Z8jxv5Mz/q55CygozbBmxzW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexploitupx

  • Possible privilege escalation attempt

    exploit

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2