Analysis
-
max time kernel
124s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 00:54
Static task
static1
Behavioral task
behavioral1
Sample
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe
-
Size
65KB
-
MD5
9a66bb1eb629e77105ae2b5a586bdd50
-
SHA1
f33e831820f6214b4cabbc027f005cfbe8c5b592
-
SHA256
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f
-
SHA512
a892a34633134e8ac9061939a18d0cf79978f0e02b1b611b187ed7e670303f40d9021da0361ab1e8fe8a9dd8d0010b66f6bfc007b8f096a92de9235a09b951e2
-
SSDEEP
1536:0INtngUfE73bmoIkFupEESb1hlkNqeFhDtkbZ0oNH:0ILgkw2uuj0TH
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/1812-1-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-5-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-7-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-11-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-9-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-8-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-6-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-4-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-3-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-10-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-31-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-32-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-33-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-35-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-34-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-37-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-38-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-39-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-40-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-42-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-44-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-51-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-53-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-55-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-57-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-60-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-71-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-72-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-74-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-76-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1812-98-0x0000000000520000-0x00000000015DA000-memory.dmp upx -
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\H: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\J: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\L: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\V: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\Y: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\E: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\G: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\K: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\P: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\Q: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\S: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\Z: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\I: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\M: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\O: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\T: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\W: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\X: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\N: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\R: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened (read-only) \??\U: 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened for modification F:\autorun.inf 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zFM.exe 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process File created C:\Windows\f7629a0 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exepid process 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Token: SeDebugPrivilege 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription pid process target process PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1732 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe DllHost.exe PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE PID 1812 wrote to memory of 1080 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe taskhost.exe PID 1812 wrote to memory of 1180 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Dwm.exe PID 1812 wrote to memory of 1212 1812 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\152cc4fa75933ecd141cb307b1bbfd79ce06778039b061fb06eaa7ce4e68d61f_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ekcotr.exeFilesize
97KB
MD58bf03e6e50c0b301fcb60fc9d9bf9b2e
SHA1254042a6f7eddf33fb3119523915cfc714b7217e
SHA256d3b258d6de982d88b6ab979948bb3520bedb920d82572d1d0ec6553ba0763317
SHA51256adf3600157386409eef58b092450589055d3724656516e7dba9e614727256833d5704b1fcbe09ad16a353e5332e34f7b13350bd68faba347adcb2806440ce6
-
memory/1080-12-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/1812-35-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-72-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-5-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-23-0x0000000004520000-0x0000000004521000-memory.dmpFilesize
4KB
-
memory/1812-24-0x0000000003B00000-0x0000000003B02000-memory.dmpFilesize
8KB
-
memory/1812-20-0x0000000004520000-0x0000000004521000-memory.dmpFilesize
4KB
-
memory/1812-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1812-11-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-9-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-8-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-6-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-4-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-3-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-10-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-30-0x0000000003B00000-0x0000000003B02000-memory.dmpFilesize
8KB
-
memory/1812-31-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-32-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-37-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-19-0x0000000003B00000-0x0000000003B02000-memory.dmpFilesize
8KB
-
memory/1812-7-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-33-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-38-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-39-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-40-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-42-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-44-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-51-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-53-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-55-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-57-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-60-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-64-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-65-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-71-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-34-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-74-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-76-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-98-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB
-
memory/1812-107-0x0000000003B00000-0x0000000003B02000-memory.dmpFilesize
8KB
-
memory/1812-1-0x0000000000520000-0x00000000015DA000-memory.dmpFilesize
16.7MB