Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 00:13
Static task
static1
Behavioral task
behavioral1
Sample
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
339ae69e221743fd181a78cad3fe7e60
-
SHA1
ea6e6b0f7c267995084d31467383ef22de89ba00
-
SHA256
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702
-
SHA512
6a96ddfaef5d03f08be2ba1c20821201cc016d76f2a9fffec9ddaa7d285b01ae850aeb8f42c72afe997c0afe21d1fbb6c0c486a7b50b19b6316205edab91a18a
-
SSDEEP
24576:RAHnh+eWsN3skA4RV1Hom2KXMmHatecJSNefwmnfGLGKRZjb35:oh+ZkldoPK8Yate6SIfBffojd
Malware Config
Extracted
formbook
4.1
as02
qwin777.com
robinhoods.live
h3jh-dal.pics
braindeadcopywriting.com
kktcbet1000.com
mpo0463.cfd
raboteshoes.com
ab1718.com
lowcrusiers.com
gregcopelandmusic.com
dkfndch.store
firstclassuni.com
00ewu1ub.com
shunweichemical.com
sugarits.com
marqify.com
mistmajik.com
trezip.online
tinytables.xyz
suestergocoaching.com
dominoad.com
specials.website
thatpilatesgirl.com
vrexpressok.com
sdegtho.com
svhomesinspections.com
rumbol88.com
dzplricfpf.com
fastcoolify.com
bloominginwholeness.com
12ser3.com
curtsreno.com
defx.ventures
dev-patel.xyz
ltyidc.com
wheiunudweowuqiwuebfyewui3.com
039c5m2ciwt99.top
pmpm.xyz
akabuka.net
parkerslandscapingllc.com
hamcast.com
jiangcapable.site
sassysensoryclips.com
arsalan.shop
thecryptocaviar.com
ofbsconsulting.com
j8j3e.cfd
cinexgltd.com
justcallnadia.com
qcyiran.com
uniseekglobal.com
milieunightclub.com
sisasimoslot.com
svizzblem.net
20644.asia
shroomberparty.com
contractcrafters.net
selectstylehome.shop
blackhillspr.com
topsolutionquality.online
diywithbje.com
simplywellcoach.com
popothebear.site
entendiendomedicare.com
sopaindam.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/668-11-0x0000000000450000-0x000000000047F000-memory.dmp formbook behavioral2/memory/668-15-0x0000000000450000-0x000000000047F000-memory.dmp formbook behavioral2/memory/1872-21-0x0000000001230000-0x000000000125F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exesvchost.exerundll32.exedescription pid process target process PID 4456 set thread context of 668 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe svchost.exe PID 668 set thread context of 3440 668 svchost.exe Explorer.EXE PID 1872 set thread context of 3440 1872 rundll32.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2868 4456 WerFault.exe 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exerundll32.exepid process 668 svchost.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe 1872 rundll32.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exesvchost.exerundll32.exepid process 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe 668 svchost.exe 668 svchost.exe 668 svchost.exe 1872 rundll32.exe 1872 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 668 svchost.exe Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeShutdownPrivilege 3440 Explorer.EXE Token: SeCreatePagefilePrivilege 3440 Explorer.EXE Token: SeDebugPrivilege 1872 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exepid process 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exepid process 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3440 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exeExplorer.EXErundll32.exedescription pid process target process PID 4456 wrote to memory of 668 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe svchost.exe PID 4456 wrote to memory of 668 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe svchost.exe PID 4456 wrote to memory of 668 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe svchost.exe PID 4456 wrote to memory of 668 4456 72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe svchost.exe PID 3440 wrote to memory of 1872 3440 Explorer.EXE rundll32.exe PID 3440 wrote to memory of 1872 3440 Explorer.EXE rundll32.exe PID 3440 wrote to memory of 1872 3440 Explorer.EXE rundll32.exe PID 1872 wrote to memory of 2580 1872 rundll32.exe cmd.exe PID 1872 wrote to memory of 2580 1872 rundll32.exe cmd.exe PID 1872 wrote to memory of 2580 1872 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\72386d293874079ed88a5f8d2ba12ba0c73d9014a1cdc8c46a4798e638ff7702_NeikiAnalytics.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 7043⤵
- Program crash
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4456 -ip 44561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/668-16-0x00000000005D0000-0x00000000005E5000-memory.dmpFilesize
84KB
-
memory/668-11-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/668-14-0x0000000001100000-0x000000000144A000-memory.dmpFilesize
3.3MB
-
memory/668-15-0x0000000000450000-0x000000000047F000-memory.dmpFilesize
188KB
-
memory/1872-18-0x0000000000E90000-0x0000000000EA4000-memory.dmpFilesize
80KB
-
memory/1872-20-0x0000000000E90000-0x0000000000EA4000-memory.dmpFilesize
80KB
-
memory/1872-21-0x0000000001230000-0x000000000125F000-memory.dmpFilesize
188KB
-
memory/3440-17-0x00000000083B0000-0x00000000084AF000-memory.dmpFilesize
1020KB
-
memory/3440-23-0x00000000083B0000-0x00000000084AF000-memory.dmpFilesize
1020KB
-
memory/3440-26-0x0000000008B20000-0x0000000008C69000-memory.dmpFilesize
1.3MB
-
memory/3440-27-0x0000000008B20000-0x0000000008C69000-memory.dmpFilesize
1.3MB
-
memory/3440-30-0x0000000008B20000-0x0000000008C69000-memory.dmpFilesize
1.3MB
-
memory/4456-10-0x00000000010D0000-0x00000000010D4000-memory.dmpFilesize
16KB