Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
28-06-2024 18:44
General
-
Target
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
1c9f8c3a353b61e83862098b10de2c40
-
SHA1
2c9dd88638e7bd8bf32714db20d4e5df1b7ca587
-
SHA256
a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133
-
SHA512
45692ef1749c18e4be4548e999e89549223c7108e92266d5d8762050c22d056f03a3c1cb48657a9584c05a3734f60bbaba31da33cd763aa9567caf86aa206b4b
-
SSDEEP
24576:vTllSppqUBMdn+Z7IDJzcUNE6HmtJJGsXC+mFKfawb+Mdl:qEUBMdqGcUNEi+JJG0lag++
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 13 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 10 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 35 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a607e58ba05335ab33472830797585843f26d60a5c90bd2371e44f2759cfb133_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\3⤵
-
C:\Windows\SysWOW64\1110cc\W43152D.EXEC:\Windows\system32\\1110cc\W43152D.EXE3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\1110cc\NT-D4F6FF87.EXEC:\Windows\SysWOW64\1110cc\NT-D4F6FF87.EXE 4|-|SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A04925|-|C:\Windows\SysWOW64\1110cc\W43152D.EXE|-|04⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fneFilesize
124KB
MD56cd56de35626fc03a82f0ff7a0384e23
SHA1102b631e34a7e99eb3bd4ef6925c9fab07426e27
SHA256d1ed7436c47976f901211f6fa8609c78afc8da4f61a6a5f18b3a5a70acb230b8
SHA51215cbf414f1dde704a46f8c81f2ff21247bb86329bfd5169c30f77e424c40caf1223e75548792448fabdb98bb145db331403c37bf972848bcbb19866c8ca5294f
-
C:\Windows\SysWOW64\1110cc\HtmlView.fneFilesize
212KB
MD54c9e8f81bf741a61915d0d4fc49d595e
SHA1d033008b3a0e5d3fc8876e0423ee5509ecb3897c
SHA256951d725f4a12cd4ff713ca147fa3be08a02367db6731283c3f1ba30445990129
SHA512cf2c6f8f471c8a5aad563bc257035515860689b73ce343599c7713de8bc8338a031a722f366e005bc1907d6fc97b68b8b415e8ff05b7324fb1040c5dc02315d7
-
C:\Windows\SysWOW64\1110cc\W43152D.EXEFilesize
47KB
MD597e6663edce7d31170933924d58129bf
SHA1cbd17532c7db5abd27ec966032d87a6593fac378
SHA25648ecf74ffa658c5adc6f29104596bcf23b1cde2b801de41f8aada08227fc0d82
SHA512c91cd62421d0c9369dec3701d7669199924783c1b58b75672ba202f6455246a8d11fc4e8b6f2e15c21b50833cfa0b408013d005566cb2b9a755e20aa6a580782
-
C:\Windows\SysWOW64\1110cc\eAPI.fneFilesize
328KB
MD57bcb58659e959d65514c45cd01bfc8e4
SHA1c2f41529a536c746ac0cf92c026dea65798f3ee7
SHA256f37248aa68d84818fba2b1ea160d7eec4d3f426eeca4d215c8db8d8389d18388
SHA5120b33bbcb059de95e74e9e115fb09ca73846720041113c9cab10e5dec40024136241d66a92181527e36db714c4c96ee532b7df00ae2c10798d8bea947f6762217
-
C:\Windows\SysWOW64\1110cc\krnln.fnrFilesize
1.1MB
MD596e899679a46227f904f680c6da36011
SHA1979350dd4b740e02ed5b893d4226ff73403068dd
SHA2561a76228343db9e3fa5185f3a4650d229f7af9e9fbf4966e864aed67aac96bca5
SHA512667e4c999d5606f5c9c151f0672b1a08269b70cb43ad80bd72cb4bd467e9d0124cdd1742fd2333da7eefa7e8223bb8427143cf75f911450fc9728fabb5cddb43
-
memory/1064-62-0x0000000002CF0000-0x0000000002D51000-memory.dmpFilesize
388KB
-
memory/1064-57-0x0000000002300000-0x0000000002338000-memory.dmpFilesize
224KB
-
memory/1064-50-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1064-82-0x0000000002DF0000-0x0000000002E11000-memory.dmpFilesize
132KB
-
memory/1064-53-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2512-101-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2512-100-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2512-98-0x0000000002220000-0x0000000002258000-memory.dmpFilesize
224KB
-
memory/2512-94-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2512-95-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2524-23-0x00000000034C0000-0x00000000034C2000-memory.dmpFilesize
8KB
-
memory/2524-1-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-12-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-0-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2524-3-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-27-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-4-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-25-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-9-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-17-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/2524-16-0x00000000034C0000-0x00000000034C2000-memory.dmpFilesize
8KB
-
memory/2524-28-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2524-71-0x00000000034C0000-0x00000000034C2000-memory.dmpFilesize
8KB
-
memory/2524-81-0x0000000010000000-0x000000001011D000-memory.dmpFilesize
1.1MB
-
memory/2524-14-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-80-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2524-76-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-45-0x0000000003C30000-0x0000000003C51000-memory.dmpFilesize
132KB
-
memory/2524-24-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-15-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB
-
memory/2524-26-0x00000000034C0000-0x00000000034C2000-memory.dmpFilesize
8KB
-
memory/2524-29-0x0000000002270000-0x000000000332A000-memory.dmpFilesize
16.7MB