Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 01:12
Static task
static1
Behavioral task
behavioral1
Sample
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
General
-
Target
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe
-
Size
293KB
-
MD5
55f3d976a99f2588c490757e772305b0
-
SHA1
604f939055cabbf0dff3b1fb9c3d8849b113b8f4
-
SHA256
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2
-
SHA512
588da8e818f7617684c23f8d5d9f8b38dec9afd28cd92180afc803211acc11d9cb2bc76250b4aac9c566b5634ebca86796c4347bde6fd8e280b9bb5e68f778a7
-
SSDEEP
6144:B5lz/EqlzbUxMrC2WMprfs5lBeUkrk14A2RYx+CMSUWx3I3AxadyzBs8kW:bx9bDm2JpLsbBVkr/Ap+CUWsEECk
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exepid process 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Cotland247 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bytningers\\Sammenrulles.exe" 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
Processes:
flow ioc 65 raw.githubusercontent.com 71 raw.githubusercontent.com 76 raw.githubusercontent.com 102 raw.githubusercontent.com 24 raw.githubusercontent.com 58 raw.githubusercontent.com 26 raw.githubusercontent.com 46 raw.githubusercontent.com 52 raw.githubusercontent.com 59 raw.githubusercontent.com 69 raw.githubusercontent.com 91 raw.githubusercontent.com 97 raw.githubusercontent.com 15 raw.githubusercontent.com 41 raw.githubusercontent.com 51 raw.githubusercontent.com 85 raw.githubusercontent.com 19 raw.githubusercontent.com 39 raw.githubusercontent.com 87 raw.githubusercontent.com 92 raw.githubusercontent.com 42 raw.githubusercontent.com 45 raw.githubusercontent.com 18 raw.githubusercontent.com 27 raw.githubusercontent.com 44 raw.githubusercontent.com 50 raw.githubusercontent.com 110 raw.githubusercontent.com 96 raw.githubusercontent.com 103 raw.githubusercontent.com 105 raw.githubusercontent.com 98 raw.githubusercontent.com 100 raw.githubusercontent.com 112 raw.githubusercontent.com 10 raw.githubusercontent.com 17 raw.githubusercontent.com 31 raw.githubusercontent.com 43 raw.githubusercontent.com 72 raw.githubusercontent.com 79 raw.githubusercontent.com 68 raw.githubusercontent.com 84 raw.githubusercontent.com 99 raw.githubusercontent.com 8 raw.githubusercontent.com 16 raw.githubusercontent.com 83 raw.githubusercontent.com 33 raw.githubusercontent.com 48 raw.githubusercontent.com 55 raw.githubusercontent.com 62 raw.githubusercontent.com 20 raw.githubusercontent.com 86 raw.githubusercontent.com 94 raw.githubusercontent.com 95 raw.githubusercontent.com 106 raw.githubusercontent.com 25 raw.githubusercontent.com 34 raw.githubusercontent.com 49 raw.githubusercontent.com 67 raw.githubusercontent.com 111 raw.githubusercontent.com 74 raw.githubusercontent.com 75 raw.githubusercontent.com 12 raw.githubusercontent.com 13 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exepid process 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 2120 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exedescription pid process target process PID 2440 set thread context of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Drops file in Program Files directory 1 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files (x86)\bensall\blodbgens.ini 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\resources\eliminer\kapitalvindingsskat.san 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\Parapegma.For 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exepid process 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exedescription pid process target process PID 2440 wrote to memory of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe PID 2440 wrote to memory of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe PID 2440 wrote to memory of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe PID 2440 wrote to memory of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe PID 2440 wrote to memory of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe PID 2440 wrote to memory of 2120 2440 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe 1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b45ed2ad7f31a3496b214836c632a3a233f01a9056135e8a787db8a3a9071d2_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\Tar51A0.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
\Users\Admin\AppData\Local\Temp\nsoE83.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
memory/2120-26-0x0000000077C40000-0x0000000077DE9000-memory.dmpFilesize
1.7MB
-
memory/2120-146-0x0000000000460000-0x00000000014C2000-memory.dmpFilesize
16.4MB
-
memory/2440-23-0x0000000004060000-0x000000000661D000-memory.dmpFilesize
37.7MB
-
memory/2440-24-0x0000000077C41000-0x0000000077D42000-memory.dmpFilesize
1.0MB
-
memory/2440-25-0x0000000077C40000-0x0000000077DE9000-memory.dmpFilesize
1.7MB
-
memory/2440-27-0x0000000004060000-0x000000000661D000-memory.dmpFilesize
37.7MB
-
memory/2440-2752-0x0000000004060000-0x000000000661D000-memory.dmpFilesize
37.7MB