sality | 1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll
Size

120KB
MD5

7144b38532c87843b7f66325935cf410
SHA1

b9c8faff7e2991498dfad842abd0b66e16a1ef01
SHA256

1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f
SHA512

5ae28fe7340445f729ea468d750994b916d568666d90fe32ac538e6edb54839a1e68e87ff1bf2466c9d83d2f38b412b7c9cbdfce134165fe6c4289053900e95c
SSDEEP

3072:HP4/LEiEUW01B4vmphKuLJuRfCnLJ+fzsTFO:v4/AiEURBWmf9mfCnLJ+fzs

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e575ef8.exee574343.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575ef8.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574343.exee575ef8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575ef8.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574343.exee575ef8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575ef8.exe

Executes dropped EXE 3 IoCs

Processes:

e574343.exee57447b.exee575ef8.exe

pid process

5088 e574343.exe
4544 e57447b.exe
740 e575ef8.exe

pid	process
5088	e574343.exe
4544	e57447b.exe
740	e575ef8.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5088-6-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-24-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-11-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-10-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-25-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-9-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-32-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-33-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-8-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-34-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-35-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-36-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-37-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-38-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-39-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-41-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-42-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-51-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-53-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-54-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-64-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-66-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-69-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-71-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-73-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-75-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-77-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-79-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-81-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/5088-83-0x0000000000780000-0x000000000183A000-memory.dmp	upx
behavioral2/memory/740-112-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx
behavioral2/memory/740-118-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574343.exee575ef8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574343.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575ef8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575ef8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575ef8.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e574343.exee575ef8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575ef8.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e574343.exe

description	ioc	process
File opened (read-only)	\??\N:	e574343.exe
File opened (read-only)	\??\O:	e574343.exe
File opened (read-only)	\??\H:	e574343.exe
File opened (read-only)	\??\J:	e574343.exe
File opened (read-only)	\??\P:	e574343.exe
File opened (read-only)	\??\R:	e574343.exe
File opened (read-only)	\??\S:	e574343.exe
File opened (read-only)	\??\G:	e574343.exe
File opened (read-only)	\??\I:	e574343.exe
File opened (read-only)	\??\M:	e574343.exe
File opened (read-only)	\??\E:	e574343.exe
File opened (read-only)	\??\L:	e574343.exe
File opened (read-only)	\??\K:	e574343.exe
File opened (read-only)	\??\Q:	e574343.exe

Drops file in Program Files directory 4 IoCs

Processes:

e574343.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e574343.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e574343.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	e574343.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e574343.exe

Drops file in Windows directory 3 IoCs

Processes:

e574343.exee575ef8.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI e574343.exe
File created C:\Windows\e57ad76 e575ef8.exe
File created C:\Windows\e574391 e574343.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e574343.exe

pid process

5088 e574343.exe
5088 e574343.exe
5088 e574343.exe
5088 e574343.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	e574343.exe
File created	C:\Windows\e57ad76	e575ef8.exe
File created	C:\Windows\e574391	e574343.exe

pid	process
5088	e574343.exe
5088	e574343.exe
5088	e574343.exe
5088	e574343.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e574343.exe

description	pid	process
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe
Token: SeDebugPrivilege	5088	e574343.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

rundll32.exerundll32.exee574343.exe

description	pid	process	target process
PID 1712 wrote to memory of 1940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 1940	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 1940	1712	rundll32.exe	rundll32.exe
PID 1940 wrote to memory of 5088	1940	rundll32.exe	e574343.exe
PID 1940 wrote to memory of 5088	1940	rundll32.exe	e574343.exe
PID 1940 wrote to memory of 5088	1940	rundll32.exe	e574343.exe
PID 5088 wrote to memory of 792	5088	e574343.exe	fontdrvhost.exe
PID 5088 wrote to memory of 800	5088	e574343.exe	fontdrvhost.exe
PID 5088 wrote to memory of 332	5088	e574343.exe	dwm.exe
PID 5088 wrote to memory of 2876	5088	e574343.exe	sihost.exe
PID 5088 wrote to memory of 2920	5088	e574343.exe	svchost.exe
PID 5088 wrote to memory of 2624	5088	e574343.exe	taskhostw.exe
PID 5088 wrote to memory of 3512	5088	e574343.exe	Explorer.EXE
PID 5088 wrote to memory of 3628	5088	e574343.exe	svchost.exe
PID 5088 wrote to memory of 3836	5088	e574343.exe	DllHost.exe
PID 5088 wrote to memory of 3924	5088	e574343.exe	StartMenuExperienceHost.exe
PID 5088 wrote to memory of 3992	5088	e574343.exe	RuntimeBroker.exe
PID 5088 wrote to memory of 4084	5088	e574343.exe	SearchApp.exe
PID 5088 wrote to memory of 4124	5088	e574343.exe	RuntimeBroker.exe
PID 5088 wrote to memory of 2996	5088	e574343.exe	TextInputHost.exe
PID 5088 wrote to memory of 4636	5088	e574343.exe	RuntimeBroker.exe
PID 5088 wrote to memory of 1712	5088	e574343.exe	rundll32.exe
PID 5088 wrote to memory of 1940	5088	e574343.exe	rundll32.exe
PID 5088 wrote to memory of 1940	5088	e574343.exe	rundll32.exe
PID 1940 wrote to memory of 4544	1940	rundll32.exe	e57447b.exe
PID 1940 wrote to memory of 4544	1940	rundll32.exe	e57447b.exe
PID 1940 wrote to memory of 4544	1940	rundll32.exe	e57447b.exe
PID 1940 wrote to memory of 740	1940	rundll32.exe	e575ef8.exe
PID 1940 wrote to memory of 740	1940	rundll32.exe	e575ef8.exe
PID 1940 wrote to memory of 740	1940	rundll32.exe	e575ef8.exe
PID 5088 wrote to memory of 792	5088	e574343.exe	fontdrvhost.exe
PID 5088 wrote to memory of 800	5088	e574343.exe	fontdrvhost.exe
PID 5088 wrote to memory of 332	5088	e574343.exe	dwm.exe
PID 5088 wrote to memory of 2876	5088	e574343.exe	sihost.exe
PID 5088 wrote to memory of 2920	5088	e574343.exe	svchost.exe
PID 5088 wrote to memory of 2624	5088	e574343.exe	taskhostw.exe
PID 5088 wrote to memory of 3512	5088	e574343.exe	Explorer.EXE
PID 5088 wrote to memory of 3628	5088	e574343.exe	svchost.exe
PID 5088 wrote to memory of 3836	5088	e574343.exe	DllHost.exe
PID 5088 wrote to memory of 3924	5088	e574343.exe	StartMenuExperienceHost.exe
PID 5088 wrote to memory of 3992	5088	e574343.exe	RuntimeBroker.exe
PID 5088 wrote to memory of 4084	5088	e574343.exe	SearchApp.exe
PID 5088 wrote to memory of 4124	5088	e574343.exe	RuntimeBroker.exe
PID 5088 wrote to memory of 2996	5088	e574343.exe	TextInputHost.exe
PID 5088 wrote to memory of 4636	5088	e574343.exe	RuntimeBroker.exe
PID 5088 wrote to memory of 4544	5088	e574343.exe	e57447b.exe
PID 5088 wrote to memory of 4544	5088	e574343.exe	e57447b.exe
PID 5088 wrote to memory of 740	5088	e574343.exe	e575ef8.exe
PID 5088 wrote to memory of 740	5088	e574343.exe	e575ef8.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e574343.exee575ef8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574343.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575ef8.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2920

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2624

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3512

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\e574343.exe
C:\Users\Admin\AppData\Local\Temp\e574343.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5088

C:\Users\Admin\AppData\Local\Temp\e57447b.exe
C:\Users\Admin\AppData\Local\Temp\e57447b.exe
4⤵
- Executes dropped EXE
PID:4544

C:\Users\Admin\AppData\Local\Temp\e575ef8.exe
C:\Users\Admin\AppData\Local\Temp\e575ef8.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3628

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3836

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3992

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4084

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4124

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2996

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e574343.exe
Filesize
97KB

MD5
b3304659798796c8c06a95bb0ceba755

SHA1
8556158323976244fcb787e77a2ea89c4a77cf79

SHA256
5cedd5c1e37451823cdb4269934e7e6ebda03e7aa80588e6d618fdd616cd8726

SHA512
b083219be9bed92301974efbc88a1deab656c12757439824014b7d25fa84162f672a509a77806f9a2cfcfb61f235ed27657dc5d78d77f8a4ac45b8b2a0518cdf

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
bc25bc68ec46109190d7cba3a6fbbf66

SHA1
9e4e2f16d2326f94e964a963c9a0d381e90ab8c4

SHA256
a270841cef22125da836379ab67e40846adca4b290844734c4fb01e8e13845a3

SHA512
db906693cc5660571684bfbcba82b96d2a25adad384df2c9377abcf0d306bf95f7af1e4ce4ae8c122780661f140ac7feafa809df7aafcb86cd0e61d34f20c2bc

Download Submit
memory/740-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/740-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/740-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/740-118-0x0000000000B20000-0x0000000001BDA000-memory.dmp

Filesize
16.7MB

Download
memory/740-112-0x0000000000B20000-0x0000000001BDA000-memory.dmp

Filesize
16.7MB

Download
memory/740-117-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/740-59-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1940-13-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

Filesize
4KB

Download
memory/1940-16-0x0000000003DB0000-0x0000000003DB2000-memory.dmp

Filesize
8KB

Download
memory/1940-12-0x0000000003DB0000-0x0000000003DB2000-memory.dmp

Filesize
8KB

Download
memory/1940-27-0x0000000003DB0000-0x0000000003DB2000-memory.dmp

Filesize
8KB

Download
memory/1940-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4544-57-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4544-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4544-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4544-104-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4544-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5088-41-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-25-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-35-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-36-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-37-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-38-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-39-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-8-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-42-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-26-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/5088-51-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-53-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-54-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-28-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/5088-33-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-32-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-9-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-34-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-10-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-64-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-66-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-69-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-71-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-73-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-75-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-77-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-79-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-81-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-83-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-84-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/5088-11-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-100-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5088-24-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-15-0x0000000001980000-0x0000000001981000-memory.dmp

Filesize
4KB

Download
memory/5088-6-0x0000000000780000-0x000000000183A000-memory.dmp

Filesize
16.7MB

Download
memory/5088-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download