Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 21:43
Behavioral task
behavioral1
Sample
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe
-
Size
326KB
-
MD5
1cc2f3553fa52983389d468abc75da80
-
SHA1
55bd533212b06e15d08260277f16df1315856d9b
-
SHA256
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0
-
SHA512
2aba39441fbd55361c02434e8b771348480aa764b1301720f6aab72c37f7a088d5018738d875bd1742a145ee2b9e746f842e0cc7cce2071a9ee3d0078c429929
-
SSDEEP
3072:h0e2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:h0sxD5cwohO+O1sVG0/pZ6iPC8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1640-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1640-55-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1640-57-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 2836 csrsll.exe 3800 csrsll.exe 1640 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/1620-0-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2028-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2028-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2028-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1620-14-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2028-21-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/2836-36-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2028-41-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2836-45-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/1640-49-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1640-54-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1640-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1640-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1640-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2836-58-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/2028-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3800-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.execsrsll.exedescription pid process target process PID 1620 set thread context of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 2836 set thread context of 3800 2836 csrsll.exe csrsll.exe PID 2836 set thread context of 1640 2836 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe Token: SeDebugPrivilege 3800 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.execsrsll.execsrsll.exepid process 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 2836 csrsll.exe 3800 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 1620 wrote to memory of 2028 1620 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe PID 2028 wrote to memory of 3192 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe cmd.exe PID 2028 wrote to memory of 3192 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe cmd.exe PID 2028 wrote to memory of 3192 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe cmd.exe PID 3192 wrote to memory of 3484 3192 cmd.exe reg.exe PID 3192 wrote to memory of 3484 3192 cmd.exe reg.exe PID 3192 wrote to memory of 3484 3192 cmd.exe reg.exe PID 2028 wrote to memory of 2836 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe csrsll.exe PID 2028 wrote to memory of 2836 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe csrsll.exe PID 2028 wrote to memory of 2836 2028 1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 3800 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe PID 2836 wrote to memory of 1640 2836 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f7e2b74e4554d7a1848163e1119374a89b4286e3c47e474b94b3db25c91d9c0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GHENF.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GHENF.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
326KB
MD542e0274c8e0ce99793c7973acccaf83b
SHA1e24db3ec582f971954355ab3029bde19b31929e5
SHA25680a087508fbbfa3662156350ddd0ed59ea1654eee5a588a6004ad24d777381e2
SHA512e5d85b37fec3c98ded5bdc574327a7cf538b65cf3ee24eb55c71230ce66424980025fa45381fdb7e585bb412cccc7030a4b2e8289cada9cd9bb00e0db265cef7
-
memory/1620-5-0x00000000021D0000-0x00000000021D2000-memory.dmpFilesize
8KB
-
memory/1620-4-0x00000000021C0000-0x00000000021C2000-memory.dmpFilesize
8KB
-
memory/1620-0-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1620-14-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1620-6-0x00000000021E0000-0x00000000021E2000-memory.dmpFilesize
8KB
-
memory/1620-3-0x00000000021B0000-0x00000000021B2000-memory.dmpFilesize
8KB
-
memory/1640-49-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-55-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-54-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2028-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2028-41-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2028-21-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2028-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2028-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2028-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2836-45-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2836-36-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2836-58-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/3800-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB