4���W����FN��(��^ǩMj|��w������`a0U��՞�(�8=�����u���[�*������7����� �F�"��ҕ�_�@8��+r�#�DH�=q�k��������T��<� v�� ��f��.A��:qˣ��È�1j��u�����]a��8a�S�y��Oa�==f����<���-y�T��*m�puJ6v�/��ٰ�p��l�T5N������ɼ'%�W�o����u�ox(�jv��~���S�^ ��`��uѧ�S �eeޗh�V��4���&�~�qh�ȩT��5��"�H�3���f����pѿ��9 *��j���<ͽ�����ڽ��i _ �0��������b�uw�jC�9�'�����������lP5�B�^n�.~[��+�|���:uє,~�-w��쥧���R���u+0w�3��Q�k5����j�_S��Js�� �#���$ӀO9m���|U\ j���r��Y%�K�Y��$m�i����r�ʾ��C�^�5` �P��n��*w�D�s�E�+hHm:�����1����y��� �>\ו�t�6�����{��uh�+�/��Y�� 0���'���gr�ˉr�� g��f��|jӍ���w���7W��uY*T0�h�0���d��n�h��J��)쫚��ujQxN뼾��L����3�jW/J�V�֮ͥ ��i��&���H�zv����D��tY��He��-��i���$Z-��DB�7�����g��C���ݑ����9 ;XGU�:]�͚����;ܠx˛��7G3�=�[� �AS�}�gQ�Oy?� -|;�8h'@�:� ��V�W�FSS���J���'~ȕ�G�ܒ�ƿd���K�� hJ:��o�3�![��N��LY��E��Ej�gr�-�֫n~|X�k���.�~WG� ��rE�*����f��/Ǩ���KG^6��s��D���E$�(��}̋Ⴝ���2��_d߶��L�4�H��S^�fJB�b��u�%ds�lK��Q����8, 9�W�f"zܫ��\ð��2�6_��y�@�v4 �������Q���y �-d9�vݮrs*Z��u�K� W�����B�K1.�k�5�MӺ"c���|�����z�/�K�.D��拹 "�.�K߀�8/(c��Μݕ��e�f80Cڋd~]��څ0 �|Xd�ěT��6�E��>,_���ԕ���n�Y��)�t;Ά\Ӗ�]�?�5���̨�����1ּ��e�Lӗ��? �SϛA��X_�y6� �R�E�����p��dd��U�����'TM���`�@燛3`�Ro�DR��� y���˦�,Z��+����kN0vK�1l�[ ��E�xB:�.O�|�$�i�P��2�����Rx�MI��M�䕿\>�3���\a��{�R@�]\qEZ� ��η���vl�cBho�w3r�Z��ժG%�]��&*ǂ:G����㧧�L]sk"�� 7�b�x��u9W��E���9 ��� ��ƥ�+�B�P�j�⋯q��L���H�����?<r=J�@�i�������I�iklX�-kJ~�q�����-�z&�̖��-˽���f]�Й56��"�d�>Tc�o5w�3�^%�����%� X#����|�rs�<>����@F�vn��NJ�W6����g*a��TP{�)���������6�7֝Zb�5^O��(ħ���/��*�W�C5D�r�O]:B3���c����*�� ,�?�)2>y�2-���w��Rr݊A�����cv�1��t�:�.��#"����pAx����$�R��v�v�<�^4�,�%I ����2����iu�L��0 �La��|�Vs�! ����[���>��ӵ�������eL�)Di�:�1��iy�j?����������&܆DY��z-���dX���ݞ��7$�zۛ�U��T��Ȑ��`�;��}�67k�0�iJ~/��Kw�?H'�M���Lc΄�q��ȥ�����sR+���:�%�oƚ �?�ҷjk�si��c��@=�V!���<Nx2����j�Hy��+������ z\?yP��b��q҆����g!>,}�.��k���!�u`����T����&Y��������0��x����ߘ�!)"�C�����\.?���G�?f�� ؉I`�&ǩ��%�=u��I|TF<\ʆ.M������;���Mu�lB�-��tc��W��x\b|������qJ���S���� �/0r"��|I0<��x@g+�}Ɯ�rr�Bg����qMn��*4{�����-��D{ۢ3�b]�E���݆ݧ��h ��YFZt"|� [��so � ����d#q����{Xj��4�W�����y��P�{�h�L����c~l�8�����T�|�Yb�BO��QR��B���3.�p���횂����S�o��&���w�m�+��\��Bh��^<:@��w��q�Z�s��0f����v[�r��R���Γ��6�3��3yHkYnb���P��T�b�����T-��l9f`����Fn�a����L�*�M���ȝ��/�����찣hW��������K��Se��pr [%M����� ӊ4N#�Y2���C�%�vP ���N�^��" f���zW��@�O2�'� G�淇�v#Q���}���}�w߮E���1RlA�}7�v��%�I̦�G�%2�ʯ��n�����g�Fo�cQ�`5!w���>8)�)2��7�․���Q�A}�����zF��FCa�L⮙�З]�m��Mўa?�S}��'� 9--��R7/��Mf��d0��' �o�T�]��㏅I�����'-J��OM��2�N+7h�$�L�� 7o�Y0<����2��JV�-\pY���l���Oo��=r���9dyq}��P��/�C�TR<��7���ތ�K&x��s�%�Q����imjN^�naޣ#f��#���e���?w���j���C|�sI�C~��\*���,���-� i�y�(i?�����`��î
Behavioral task
behavioral1
Sample
050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.exe
-
Size
3.7MB
-
MD5
95b57e8308d8381af90ecf81d4a88270
-
SHA1
281af8e192dc3aa2043086cecae66c5a40aacf84
-
SHA256
050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98
-
SHA512
11d8d65c46be759350e90d951d085ada1ecab91e81460051ed72309b4328d6204fadfde058c547f9f56113cb6bb7a84bc14576ae92b40fdc8493c7f2a9bfe85c
-
SSDEEP
98304:BpnlWxJez0NDyUV66fZQTfLTNPWGIbLmek5PPhWC:4bhDyU4JfAG46f5Rt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.exe
Files
-
050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.exe.dll windows:4 windows x86 arch:x86
e28b1fb3713d72cd25ae73c160a3d884
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExA
GetVersion
SetFilePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
ws2_32
select
Exports
Exports
Sections
.text Size: - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 832KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ