nanocore | 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Size

243KB
MD5

21a74c8ef323e2da70e8e456371a5e90
SHA1

1cdc4206ff216e5e36a203a96e49b7912799aa0a
SHA256

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b
SHA512

5c9642696157994360c282616e089cd6edb0e719a1f811f399cd6cbec2dd9afa56cf912b6531aacac0825412e46e32fbabc0a56c3945724716ae34e1829cbbea
SSDEEP

6144:k9dta6dtJmakIM5Q2bTnvHbLOupQe4li2+YLV6h:stpmkRizzLVpEs2+YLV6h

Score

10^/10

nanocore neshta evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

dramzx69.ddns.net:54984

127.0.0.1:54984

Mutex

ed92ea49-3bb1-45be-97d5-43264f46dd22

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2021-08-21T05:24:08.523884236Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
sender
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
ed92ea49-3bb1-45be-97d5-43264f46dd22
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
dramzx69.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Detect Neshta payload 2 IoCs

Processes:

resource yara_rule

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta
behavioral1/memory/2044-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid process

2000 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

resource	yara_rule
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
behavioral1/memory/2044-95-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Loads dropped DLL 4 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid	process
2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\TCPSER~1\tcpsv.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description ioc process

File opened for modification C:\Windows\svchost.com 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Modifies registry class 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid	process
2000	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2000	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
2000	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

pid process

2000 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description pid process

Token: SeDebugPrivilege 2000 6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	2000	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

description	pid	process	target process
PID 2044 wrote to memory of 2000	2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
PID 2044 wrote to memory of 2000	2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
PID 2044 wrote to memory of 2000	2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
PID 2044 wrote to memory of 2000	2044	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe	6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\3582-490\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\6e14711ab76c47ea570f8428b845afb69a56835e4cfb37687b9e8002f75c1e7b_NeikiAnalytics.exe
Filesize
202KB

MD5
9c4dcf741e76d2c6fd7ddd651e1e41cc

SHA1
4f4b01a8ccdcfcfe59e4afdf79df2375d65aa968

SHA256
f5e04ad6c516a27d72b4ba6c00c273fb8ef5db587b3a8042c1a589ce00e4324a

SHA512
0c861e0f7ce7ae2181c03248961d98f9786626bbb9e140305658518bcbc654f35ae2ab0d1672852b7c5f370920602941b0b2336ac80e093992cab2796a1700a6

Download Submit
memory/2000-15-0x0000000073E31000-0x0000000073E32000-memory.dmp

Filesize
4KB

Download
memory/2000-16-0x0000000073E30000-0x00000000743DB000-memory.dmp

Filesize
5.7MB

Download
memory/2000-17-0x0000000073E30000-0x00000000743DB000-memory.dmp

Filesize
5.7MB

Download
memory/2000-96-0x0000000073E30000-0x00000000743DB000-memory.dmp

Filesize
5.7MB

Download
memory/2044-95-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download