Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 05:29
Static task
static1
Behavioral task
behavioral1
Sample
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe
-
Size
65KB
-
MD5
535ebe1e2d3db1183c3d03ee84089d80
-
SHA1
a5ba62d899fd8493f575ada2cb8bda7faed9fee2
-
SHA256
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575
-
SHA512
a2df122765c36eb0246c5c7bb6b99adf529d7049be5f4a259e9a863e47659241513120474b674443479a9c03ea151474618e200e4fb10fbf2e79ee8ffd39e9a9
-
SSDEEP
1536:fI2GlfINCFjZft25R1DYHcOIDx/4+nUkVYqD7eDJUNW8GwbhcE:RNK0lY84+UkVYqDSNUhGxE
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2072-2-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-7-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-9-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-4-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-11-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-12-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-10-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-8-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-6-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-5-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-31-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-32-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-33-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-35-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-34-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-37-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-38-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-39-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-41-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-43-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-48-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-49-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-51-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-54-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-58-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-62-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-63-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-65-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-68-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-70-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-75-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2072-76-0x00000000006A0000-0x000000000175A000-memory.dmp upx -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\R: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\Y: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\H: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\K: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\T: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\V: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\W: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\X: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\Z: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\M: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\N: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\S: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\U: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\P: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\Q: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\I: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\J: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\L: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\O: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\E: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\G: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened for modification F:\autorun.inf 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\autorun.inf 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File created C:\Windows\f7619e7 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exepid process 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription pid process target process PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1904 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe DllHost.exe PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 2072 wrote to memory of 1068 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhost.exe PID 2072 wrote to memory of 1144 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Dwm.exe PID 2072 wrote to memory of 1192 2072 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\oakrwi.exeFilesize
97KB
MD5e0f56a934f4437ac9293dff769a84777
SHA1d5aada34c13d89436d40ac927f4f4d54ab80978f
SHA256c7a278a0d6b9f12e75befc32d5a34891010da4bc7cdc671e9fb6da355763d559
SHA51206e76be53da35a1d3159a4085c75e28c349995e981b177ba23e2f682a95e98f6321974b089af529ce2014ef3e528d82507de445b3b1dcc1de241e527e0255e6a
-
memory/1068-18-0x0000000000210000-0x0000000000212000-memory.dmpFilesize
8KB
-
memory/2072-35-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-68-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-4-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-11-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-12-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-10-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-8-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-6-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-5-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-29-0x00000000018F0000-0x00000000018F2000-memory.dmpFilesize
8KB
-
memory/2072-30-0x00000000018F0000-0x00000000018F2000-memory.dmpFilesize
8KB
-
memory/2072-28-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/2072-26-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/2072-37-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-7-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-31-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-32-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-33-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-88-0x00000000018F0000-0x00000000018F2000-memory.dmpFilesize
8KB
-
memory/2072-9-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-25-0x00000000018F0000-0x00000000018F2000-memory.dmpFilesize
8KB
-
memory/2072-38-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-39-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-41-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-43-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-48-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-49-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-51-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-54-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-58-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-62-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-63-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-65-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-34-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-70-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-75-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-76-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB
-
memory/2072-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2072-2-0x00000000006A0000-0x000000000175A000-memory.dmpFilesize
16.7MB