Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 18:44
Static task
static1
Behavioral task
behavioral1
Sample
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
1c9f8c3a353b61e83862098b10de2c40
-
SHA1
2c9dd88638e7bd8bf32714db20d4e5df1b7ca587
-
SHA256
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133
-
SHA512
45692ef1749c18e4be4548e999e89549223c7108e92266d5d8762050c22d056f03a3c1cb48657a9584c05a3734f60bbaba31da33cd763aa9567caf86aa206b4b
-
SSDEEP
24576:vTllSppqUBMdn+Z7IDJzcUNE6HmtJJGsXC+mFKfawb+Mdl:qEUBMdqGcUNEi+JJG0lag++
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Drops startup file 2 IoCs
Processes:
W43152D.EXEdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B42FBB.lnk W43152D.EXE File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\B42FBB.lnk W43152D.EXE -
Executes dropped EXE 2 IoCs
Processes:
W43152D.EXENT-613AE11E.EXEpid process 2380 W43152D.EXE 2500 NT-613AE11E.EXE -
Loads dropped DLL 14 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exeW43152D.EXENT-613AE11E.EXEpid process 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2500 NT-613AE11E.EXE 2500 NT-613AE11E.EXE -
Processes:
resource yara_rule behavioral1/memory/2112-6-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-13-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-14-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-19-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-12-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-17-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-16-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-18-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-11-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-15-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-88-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-89-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx behavioral1/memory/2112-109-0x0000000001DE0000-0x0000000002E9A000-memory.dmp upx -
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NT-613AE11E.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\167A83 = "C:\\Windows\\SysWOW64\\1110cc\\W43152D.EXE" NT-613AE11E.EXE -
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Drops file in System32 directory 10 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exeW43152D.EXEdescription ioc process File created C:\Windows\SysWOW64\1110cc\W43152D.TXT a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\1110cc\3db599cd.txt W43152D.EXE File created C:\Windows\SysWOW64\1110cc\NT-613AE11E.EXE W43152D.EXE File created C:\Windows\SysWOW64\1110cc\krnln.fnr a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File created C:\Windows\SysWOW64\1110cc\eAPI.fne a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File created C:\Windows\SysWOW64\1110cc\HtmlView.fne a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File created C:\Windows\SysWOW64\1110cc\internet.fne a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File created C:\Windows\SysWOW64\1110cc\dp1.fne a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File created C:\Windows\SysWOW64\1110cc\W43152D.EXE a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File created C:\Windows\SysWOW64\1110cc\3db599cd.txt W43152D.EXE -
Drops file in Windows directory 2 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process File created C:\Windows\f760f8b a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 37 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 740031000000000055587b701100557365727300600008000400efbeee3a851a55587b702a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c0031000000000055585775100041646d696e00380008000400efbe55587b70555857752a00000031000000000003000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000005558b37110204c6f63616c00380008000400efbe55587b705558b3712a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 520031000000000055587b70122041707044617461003c0008000400efbe55587b7055587b702a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000dc589d95102054656d700000360008000400efbe55587b70dc589d952a000000ff010000000002000000000000000000000000000000540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exepid process 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Token: SeDebugPrivilege 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exeW43152D.EXENT-613AE11E.EXEpid process 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2380 W43152D.EXE 2500 NT-613AE11E.EXE 2500 NT-613AE11E.EXE 2500 NT-613AE11E.EXE 2500 NT-613AE11E.EXE 2500 NT-613AE11E.EXE 2500 NT-613AE11E.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exeW43152D.EXEdescription pid process target process PID 2112 wrote to memory of 3064 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe explorer.exe PID 2112 wrote to memory of 3064 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe explorer.exe PID 2112 wrote to memory of 3064 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe explorer.exe PID 2112 wrote to memory of 3064 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe explorer.exe PID 2112 wrote to memory of 1116 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe taskhost.exe PID 2112 wrote to memory of 1172 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Dwm.exe PID 2112 wrote to memory of 1204 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe Explorer.EXE PID 2112 wrote to memory of 344 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe DllHost.exe PID 2112 wrote to memory of 3064 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe explorer.exe PID 2112 wrote to memory of 3064 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe explorer.exe PID 2112 wrote to memory of 2380 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe W43152D.EXE PID 2112 wrote to memory of 2380 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe W43152D.EXE PID 2112 wrote to memory of 2380 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe W43152D.EXE PID 2112 wrote to memory of 2380 2112 a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe W43152D.EXE PID 2380 wrote to memory of 2500 2380 W43152D.EXE NT-613AE11E.EXE PID 2380 wrote to memory of 2500 2380 W43152D.EXE NT-613AE11E.EXE PID 2380 wrote to memory of 2500 2380 W43152D.EXE NT-613AE11E.EXE PID 2380 wrote to memory of 2500 2380 W43152D.EXE NT-613AE11E.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\3⤵
-
C:\Windows\SysWOW64\1110cc\W43152D.EXEC:\Windows\system32\\1110cc\W43152D.EXE3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\1110cc\NT-613AE11E.EXEC:\Windows\SysWOW64\1110cc\NT-613AE11E.EXE 4|-|SOFTWARE\Microsoft\Windows\CurrentVersion\Run\167A83|-|C:\Windows\SysWOW64\1110cc\W43152D.EXE|-|04⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\1110cc\HtmlView.fneFilesize
212KB
MD54c9e8f81bf741a61915d0d4fc49d595e
SHA1d033008b3a0e5d3fc8876e0423ee5509ecb3897c
SHA256951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129
SHA512cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7
-
\Users\Admin\AppData\Local\Temp\E_N4\dp1.fneFilesize
124KB
MD56cd56de35626fc03a82f0ff7a0384e23
SHA1102b631e34a7e99eb3bd4ef6925c9fab07426e27
SHA256d1ed7436c47976f901211f6fa8609c78afc8da4f61a6a5f18b3a5a70acb230b8
SHA51215cbf414f1dde704a46f8c81f2ff21247bb86329bfd5169c30f77e424c40caf1223e75548792448fabdb98bb145db331403c37bf972848bcbb19866c8ca5294f
-
\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnrFilesize
1.1MB
MD596e899679a46227f904f680c6da36011
SHA1979350dd4b740e02ed5b893d4226ff73403068dd
SHA2561a76228343db9e3fa5185f3a4650d229f7af9e9fbf4966e864aed67aac96bca5
SHA512667e4c999d5606f5c9c151f0672b1a08269b70cb43ad80bd72cb4bd467e9d0124cdd1742fd2333da7eefa7e8223bb8427143cf75f911450fc9728fabb5cddb43
-
\Windows\SysWOW64\1110cc\W43152D.EXEFilesize
47KB
MD597e6663edce7d31170933924d58129bf
SHA1cbd17532c7db5abd27ec966032d87a6593fac378
SHA25648ecf74ffa658c5adc6f29104596bcf23b1cde2b801de41f8aada08227fc0d82
SHA512c91cd62421d0c9369dec3701d7669199924783c1b58b75672ba202f6455246a8d11fc4e8b6f2e15c21b50833cfa0b408013d005566cb2b9a755e20aa6a580782
-
\Windows\SysWOW64\1110cc\eAPI.fneFilesize
328KB
MD57bcb58659e959d65514c45cd01bfc8e4
SHA1c2f41529a536c746ac0cf92c026dea65798f3ee7
SHA256f37248aa68d84818fba2b1ea160d7eec4d3f426eeca4d215c8db8d8389d18388
SHA5120b33bbcb059de95e74e9e115fb09ca73846720041113c9cab10e5dec40024136241d66a92181527e36db714c4c96ee532b7df00ae2c10798d8bea947f6762217
-
memory/1116-21-0x0000000000190000-0x0000000000192000-memory.dmpFilesize
8KB
-
memory/2112-15-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-6-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-17-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-16-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-18-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-11-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-0-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2112-56-0x0000000004EC0000-0x0000000004EE1000-memory.dmpFilesize
132KB
-
memory/2112-44-0x0000000002F20000-0x0000000002F22000-memory.dmpFilesize
8KB
-
memory/2112-45-0x0000000002F20000-0x0000000002F22000-memory.dmpFilesize
8KB
-
memory/2112-33-0x0000000002F30000-0x0000000002F31000-memory.dmpFilesize
4KB
-
memory/2112-31-0x0000000002F30000-0x0000000002F31000-memory.dmpFilesize
4KB
-
memory/2112-30-0x0000000002F20000-0x0000000002F22000-memory.dmpFilesize
8KB
-
memory/2112-19-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-68-0x0000000003130000-0x000000000313F000-memory.dmpFilesize
60KB
-
memory/2112-14-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-13-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-69-0x0000000003130000-0x000000000313F000-memory.dmpFilesize
60KB
-
memory/2112-9-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2112-109-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-110-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2112-12-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-108-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2112-89-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2112-88-0x0000000001DE0000-0x0000000002E9A000-memory.dmpFilesize
16.7MB
-
memory/2380-130-0x0000000001DB0000-0x0000000001DBC000-memory.dmpFilesize
48KB
-
memory/2380-75-0x00000000001B0000-0x00000000001E8000-memory.dmpFilesize
224KB
-
memory/2380-87-0x0000000001CB0000-0x0000000001CD1000-memory.dmpFilesize
132KB
-
memory/2380-83-0x0000000000480000-0x00000000004E1000-memory.dmpFilesize
388KB
-
memory/2380-131-0x0000000001DB0000-0x0000000001DBF000-memory.dmpFilesize
60KB
-
memory/2380-70-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2380-73-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2380-132-0x0000000001DB0000-0x0000000001DBF000-memory.dmpFilesize
60KB
-
memory/2380-92-0x0000000001CF0000-0x0000000001CFC000-memory.dmpFilesize
48KB
-
memory/2500-137-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2500-136-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2500-134-0x0000000000220000-0x0000000000258000-memory.dmpFilesize
224KB
-
memory/2500-138-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2680-81-0x0000000003900000-0x0000000003910000-memory.dmpFilesize
64KB
-
memory/3064-78-0x0000000000020000-0x0000000000022000-memory.dmpFilesize
8KB
-
memory/3064-39-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/3064-47-0x0000000000020000-0x0000000000022000-memory.dmpFilesize
8KB