B6�e ؠ;/�ոh�z��̇#8b�,����bF-ꬥ�q�ҁ�I �j�~�Mp%,�3{��ÛBjㅋ1� �尕�}��F�Pk��h���c�Z�qV3t)K�)Kx��y%ق4`�cJR��UFm�B�]���p��]{nrH���+*t#[�W1?�wC�֞�*o:!��������r�YwFi��k�����q�!�RT��+��Ġ�~��^G��o�A@i�:}���$��qD-�$&����K�'F����>�.���&�;q���(y$i���S����qu�,���0ɿa���ъ���Q�r{���"9#'�������i��3�f��ϙmE�W�G��e��<�i7�C{9�涭�] �ę�}����� �$�� C��iz��c 7Rɧ"��ӱhE��>C�����\�0���6��ΒG��~rP��P��W����s<KRY�OE��:�%l��gD �Sn�o���ZQ]���y/먼��\2C03���h��9aڜn�Ӓ� u�D>���+�C�2;��H�&��i��oJ�H�ԓ�,-� %=s�{�,��E6�)I���8��!���F,��7� �?��HD����8��N�Ȯ�e���t7Æ��O)qP-�(������D���Sc�e�yT5���9'�������J�A����<jI�=��E�|!���mm��Ӻ>���S�ʶ~4�Y��c1����̥�P�)����S̀ˤ�<�*��`�L�uE����3|�m[˦�}Sy.y�d��ua���:m��7�H��FGWy��N#�DIaq7}i������8w�P8p(��SEp�?�u�*��)�2ս���!�Q�V����o'�B:{`|�ʞ��`2��$�M�`c2'hgwY�:Y���2������ �~3;�}�'��ݜ-TQ�����5�6j04�2.�6W'��q����M�] ��^yndN�j�d�M������no�ss�X�(!��U�Ѣ��Vp'��k��o�*"�n�Ea�;�ĉ4a���$1+q�u&�( �oI@Y� �b%�6Ú��D�k�qV]��Y�U�Xs�q�U�i ~�د�-Q��f�7D�<йh�h�*ժ�纈�R���R�n~(jX�Eygv8���B��z�'�oŪ@��@���,���"q�N�yG��=z6[�@ ��)R�kCص�b��gI���6hՈ)`d�W`3���U�ņ��3��,���h���M��g�f1�{���\��˲2a�ut��sU",��h,�T�`��X+vG{�" ��Q����@z�-J:'���1�X� ���_㚩�S6d��_�,�A�(�����''�C�<����� �ޝw�����?��x ����L�l ��a���#��OޤN��2�)e��o�G��R�8p����դ�{DF�3+��� ��Q�����(�Ǖ�!���m���)8oR.�^H�Ƞ�/^���uˢ����F$n�gѾA�R/h���Ш�A�H��uXu�]�B��^x�0��/�����, TɥB�T�QW�N;I��)�@>����}�c.c/�Ŧ;3�F�����\����3q9�+({��\�Ӽ"�� O5 ,���f<�� @Xv/21�� ��8y�N{��<�k���x, _>��m�7.`�u��&eV�̵1sZw^�05��+�� l*���Wc�qwe�4>�����cuO�N������~(�龡m;� 4�t��)�Z�k ���i��d&>#\�������D�Y���a�����+d=G������ʊe���5���[p�#�G�p�m+b8���œy�P@fj�G?v1���ֈE>�I�x��B)� ]�2HF\0�/~�|���J0��Myw�o~���N�-tjqK*Q����_���j{B���ZL��;�����gړb($b �+�$_K=\�:_l:��v��b�+�;o.����lu�x��X�~�f��}�C�^4����O�v���m�B���|�h`����͌�兺��)p<�߮q��Ռ_���S4iJ;�� �����zN�ӌIʋyn�$�^�8��|T1�����>a��jV����k�I���n̈ējx��8į0�>z�z?��� ����B$��^(�3���������j�Ⱦb��<��>�-�vt@�������a�����S\ۘNA�.�n*��3��� �^���@��A7pb*�藋B��?�`q��;s0bʱ}[��*ծ������Z�!U�G�f���Bk�EC�/Rk�o(o2��c-;�Y�b3ij30���d���:�83Vl�Ɣ���"HI�p!�=�5J�����+���;3J��}��4�=���%��)���m�%'�ܲH��DXtp��FzK����31�e����t�f��ñmJӓ�۞�ڤ��郲($��`�]z��W� �@� |�.9݉5m� N!�P X���K8���eM���k�L�j� �qm�B���.���~��L�L_Tp�3� ���l�d���d+X~?m/j�K�خp�H�Qc��h�>�<��Ձ��=M%l=W�^&��<�\��+�=?B��Qr8�Eioen(l@3����Z��|�UE�θ6�l�K*�b���ڨ��:dg���PO�Qg�?���i��K�`�ɺj�b5�j�����������t/�B�\Y�2�P[��͠�!r�v@d'�8��^m{���������.�,���������\�)YσL{s�hҜ���ٲ��������JU�>�YO������gܒ���崸�Ym��@����795�έ�����X����T��n�ʂ�����a|P�H��R�vA���Đ�P�������SC�9��I��Ei�Z�+�0�m��|V�@,w��?\�b�Fyڄ%���N$˙��)iQol7�x��t�Po:�D�yAE��C��'S��Q���(L^ �Q���Ï'����h���;t�,�.T�%�+ �7�߃�X�b��k�_w/٥Gѱ�u��Ȅ"�n�?�y�4 ��܊�ЌCq��`�d��'߂m��{5�9u�������H*0~��}@�B��;�
Static task
static1
Behavioral task
behavioral1
Sample
36a4e0eee17e3d6b7abe09582fc8e832cfc05fce07614c39ced5f9869daf6e46_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
36a4e0eee17e3d6b7abe09582fc8e832cfc05fce07614c39ced5f9869daf6e46_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
36a4e0eee17e3d6b7abe09582fc8e832cfc05fce07614c39ced5f9869daf6e46_NeikiAnalytics.exe
-
Size
7.0MB
-
MD5
c7524729bc45db3875e9addf87c93a30
-
SHA1
ba508117ed4ad7cbc3db8152f5635237fae7b2c8
-
SHA256
36a4e0eee17e3d6b7abe09582fc8e832cfc05fce07614c39ced5f9869daf6e46
-
SHA512
7d82046affc0494b8269aa8451d7a40c2c4ea53a4f980dd5e15e9e3387f726b70d2d0026c228cfcbbadeb447defbbf7e2a1ec89093ca8781fe1b4b4470dfb7a3
-
SSDEEP
98304:bqqZV8yrJISGsMuocD7JAkOaxENWxAmW+vyNCceRybc4q7jmevJzcJEtBN5gd:2oVRXocD9eaG4xAh+iCNi5KRYA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36a4e0eee17e3d6b7abe09582fc8e832cfc05fce07614c39ced5f9869daf6e46_NeikiAnalytics.exe
Files
-
36a4e0eee17e3d6b7abe09582fc8e832cfc05fce07614c39ced5f9869daf6e46_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
2024bc9a6bff26851c908e5e38b2e75f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForMultipleObjects
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
CharUpperBuffW
advapi32
CryptEncrypt
ole32
CoCreateInstance
oleaut32
VariantClear
msvcp140
?good@ios_base@std@@QEBA_NXZ
d3d9
Direct3DCreate9
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ws2_32
gethostname
normaliz
IdnToAscii
crypt32
CertFreeCertificateContext
wldap32
ord217
Exports
Exports
Sections
.text Size: - Virtual size: 457KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.AES0 Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.AES1 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AES2 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ