Overview

overview

10

Static

static

3

45847e0fdc...cs.exe

windows7-x64

7

45847e0fdc...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2024, 10:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
  • Size 42KB
  • Sample240702-l39fma1dql
  • SHA256 45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\45847e0fdce3567567587a1cd446b28de1095670fb23b960f2193641b843d36e_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        search58ZP0SPG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\search58ZP0SPG.htm
        • Size 114KB
        • SHA256 8361bc1c5ee6c705881e3253138037f3426b3ebe5ce4b32efc70cb87c5a41fc5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchO2CRPEXX.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\searchO2CRPEXX.htm
        • Size 126KB
        • SHA256 dc986ef7f8bda70861f7e1d988d64210a1d49019dd113423c98cf5b7d88bce97
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0RV7W6KN\search[1].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        59UV56W8.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6TQEXKX3\59UV56W8.htm
        • Size 175KB
        • SHA256 b657cfa77479ca17618b01ea130f8ed36c686cdf49559354f8fd1ca9daf8c9bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6TQEXKX3\default[2].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        search0F0HW5TN.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKWDYRX8\search0F0HW5TN.htm
        • Size 138KB
        • SHA256 af1370bb047db36f53da34707d93e0da5c9d12684ca4427a66fcca71d9bb6365
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchGFR12UTQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKWDYRX8\searchGFR12UTQ.htm
        • Size 121KB
        • SHA256 b22ac09cdd7d423393670c9589d1c18f74916e4fe388355443c8de452b9129d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\results[1].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\results[5].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search90PW80UD.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\search90PW80UD.htm
        • Size 161KB
        • SHA256 a4c030500f2226a09c9d015014ee4bf9c94cba89ab51559c2cc11fff7e0be08d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchLAY06H4S.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\searchLAY06H4S.htm
        • Size 143KB
        • SHA256 77096770375373d9338297faa42d5d01a759bac92fde51222dc89893b50fad3a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGYR01BB\search[4].htm
        • Size 130KB
        • SHA256 070b4ba8d7c9f8fefbbf3103114c6ed66b00ee9337973566bf8286ed174e54a5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp4004.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp4004.tmp
        • Size 42KB
        • SHA256 6ed58d1160fd1292125614eec5336e2d5794b57436db23142aebe56f60149ead
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 96B
        • SHA256 51847b52171e2eb4b143ea4c2917af992b84cfd7b3fd553478345427f83f3bd7
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 96B
        • SHA256 8a99324d31f50ee66ea59facf99f6789c1afa8f13ea7a9ce6e822a57b56bc92d
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 96B
        • SHA256 06b93565c16eab01d26fcec4590ba39794963a74b96b3dc6ecb48d2ae5a4daec
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 96B
        • SHA256 bbd57e1423fcb4b644f79adcd2d0c25339cef862118066d67be9a1c8b2fec96f
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 96B
        • SHA256 7de7ac04bb6c1b668b031605fe0da3279c7e45ddbae4cfdf73fa22138aeee159
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/752-30-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-251-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-248-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-309-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-164-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-5-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-252-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-22-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-21-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-483-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-17-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-13-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-503-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/752-506-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4632-0-0x0000000000500000-0x0000000000511000-memory.dmp
        Download