Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 14:27
Behavioral task
behavioral1
Sample
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe
-
Size
90KB
-
MD5
460b2a7276f55c4cf85b2137cda0a5f0
-
SHA1
f9edcbf61b306db1fc1e2e6cb935db8135d31885
-
SHA256
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba
-
SHA512
3590e143fde4fc886770e7a1eeb63fb9f78f7ef3efa2c33727687e0135a6bd5a1f27578245f6c0359cb36e78a71ee5669531805e5713cdca048fd8a30e49846e
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2428-52-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2428-49-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2428-53-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/2428-60-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 1452 csrsll.exe 4708 csrsll.exe 2428 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/4228-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/732-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/732-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/732-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4228-9-0x0000000002200000-0x0000000002202000-memory.dmp upx behavioral2/memory/4228-13-0x0000000000400000-0x0000000000453000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/1452-35-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1452-39-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2428-44-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2428-48-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2428-52-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2428-49-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/1452-56-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4708-54-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2428-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/732-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4708-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2428-60-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.execsrsll.exedescription pid process target process PID 4228 set thread context of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 1452 set thread context of 4708 1452 csrsll.exe csrsll.exe PID 1452 set thread context of 2428 1452 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe Token: SeDebugPrivilege 4708 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.execsrsll.execsrsll.exepid process 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 1452 csrsll.exe 4708 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 4228 wrote to memory of 732 4228 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe PID 732 wrote to memory of 2712 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 732 wrote to memory of 2712 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 732 wrote to memory of 2712 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe cmd.exe PID 2712 wrote to memory of 4540 2712 cmd.exe reg.exe PID 2712 wrote to memory of 4540 2712 cmd.exe reg.exe PID 2712 wrote to memory of 4540 2712 cmd.exe reg.exe PID 732 wrote to memory of 1452 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 732 wrote to memory of 1452 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 732 wrote to memory of 1452 732 9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 4708 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe PID 1452 wrote to memory of 2428 1452 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c49827fd4fb2e23d65272d1d552768bc2161d7f363f9a22451fa9f735e081ba_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HLGOC.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HLGOC.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
90KB
MD5cf19eab65fc39fb92049febd7673f7cb
SHA105bf454a2ab156299d86e4dbfd3a59d65e79dee5
SHA25691d88d9b06314c1e1c5fa6f7d079eef52cd7000c3f135c892b189445db7b9a8a
SHA512b664ba33383a8a972f93a7bf1d922dbd46302388ebd714f635ec089111544abb06bd3738b5595cbded8b0f558b14e4ebdf14ab6ee3971ecceee1d6f8b5d13ca6
-
memory/732-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/732-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/732-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/732-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1452-56-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1452-39-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/1452-35-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2428-49-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2428-44-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2428-48-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2428-52-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2428-53-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2428-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4228-13-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4228-8-0x00000000021F0000-0x00000000021F2000-memory.dmpFilesize
8KB
-
memory/4228-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4228-9-0x0000000002200000-0x0000000002202000-memory.dmpFilesize
8KB
-
memory/4228-3-0x00000000021E0000-0x00000000021E2000-memory.dmpFilesize
8KB
-
memory/4708-54-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4708-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB