Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 05:30
Behavioral task
behavioral1
Sample
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe
-
Size
90KB
-
MD5
e92d3daa44e462aa3a63e5be0b220770
-
SHA1
0f520c517eea5d8627f9a11328af6d22fdfa17df
-
SHA256
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723
-
SHA512
2fb9de03d7743ff441e71071c6935361cfe847f974a6b578fb72894b510022624c6b9ec2ee52eb033a99b067f360a113847a450e20fa9bf42aeb6e6cca09ebd1
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4856-59-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4856-60-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4856-61-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4856-65-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 5028 csrsll.exe 380 csrsll.exe 4856 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/3936-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3936-3-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3936-4-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3936-6-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1472-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1472-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1472-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3936-16-0x0000000000400000-0x0000000000453000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/5028-38-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1472-42-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5028-43-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5028-44-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4856-52-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5028-56-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4856-58-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4856-59-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4856-60-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4856-61-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1472-63-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/380-64-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4856-65-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.execsrsll.exedescription pid process target process PID 3936 set thread context of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 5028 set thread context of 380 5028 csrsll.exe csrsll.exe PID 5028 set thread context of 4856 5028 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe Token: SeDebugPrivilege 380 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.execsrsll.execsrsll.exepid process 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 5028 csrsll.exe 380 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 3936 wrote to memory of 1472 3936 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe PID 1472 wrote to memory of 3156 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe cmd.exe PID 1472 wrote to memory of 3156 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe cmd.exe PID 1472 wrote to memory of 3156 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe cmd.exe PID 3156 wrote to memory of 1468 3156 cmd.exe reg.exe PID 3156 wrote to memory of 1468 3156 cmd.exe reg.exe PID 3156 wrote to memory of 1468 3156 cmd.exe reg.exe PID 1472 wrote to memory of 5028 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe csrsll.exe PID 1472 wrote to memory of 5028 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe csrsll.exe PID 1472 wrote to memory of 5028 1472 87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 380 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe PID 5028 wrote to memory of 4856 5028 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\87ac74e90e266ea95f67c8133b66bc0740a45f6a89c057ddc3caee2a6bb3e723_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OPMVH.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OPMVH.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
90KB
MD5847587d80a5cab1e2db06c963b9e8933
SHA17912191f18f68d57c970f015da947de886b450d3
SHA256adb37243dabb2b5a513b83b44171dc5141b1dbdb1923fe4108b674fc8d63adff
SHA512778de56963f9c5795fa90b1588b509a1db409664b25810b5dc303a1ec1b1459ccbf2b008a938c851614a0e3c6805ba54f7b8dd0f6c3d6895dcf2cc6222b57d05
-
memory/380-64-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1472-13-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1472-63-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1472-62-0x0000000000410000-0x00000000004D9000-memory.dmpFilesize
804KB
-
memory/1472-42-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1472-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1472-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3936-6-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3936-16-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3936-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3936-7-0x0000000002340000-0x0000000002342000-memory.dmpFilesize
8KB
-
memory/3936-3-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3936-8-0x0000000002BA0000-0x0000000002BA2000-memory.dmpFilesize
8KB
-
memory/3936-4-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3936-5-0x0000000002320000-0x0000000002322000-memory.dmpFilesize
8KB
-
memory/4856-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4856-58-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4856-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4856-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4856-52-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4856-65-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5028-56-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/5028-44-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/5028-43-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/5028-38-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB