sality | 2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90_NeikiAnalytics.dll
Size

120KB
MD5

d69dfec7f5a9e84d55c3510d787271f0
SHA1

eb3aa83ddbb5f64d6f0846dcc4753d9de7847fd8
SHA256

2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90
SHA512

75fc6c571fcbdf0d98c0cfb2ae8c77f28252e0a13d66fd2b0451976d522a5ea9621bbda15af56ed88cb14f52f9e69648c207b31f606015fa85432214c12af666
SSDEEP

3072:WblUlsAESGBIh658GqAdQ4PWVFJqajhkrdoTHuIpltTcVs:htDGBI1GJLEJu6TOkT7

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e573b73.exee575709.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e573b73.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573b73.exee575709.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575709.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573b73.exee575709.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575709.exe

Executes dropped EXE 3 IoCs

Processes:

e573b73.exee573cca.exee575709.exe

pid process

1640 e573b73.exe
1088 e573cca.exe
2848 e575709.exe

pid	process
1640	e573b73.exe
1088	e573cca.exe
2848	e575709.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1640-6-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-9-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-8-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-20-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-19-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-31-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-33-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-11-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-10-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-34-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-35-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-36-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-37-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-38-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-39-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-41-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-42-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-51-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-53-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-54-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-64-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-66-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-69-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-71-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-73-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-75-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-77-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-79-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-81-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/1640-83-0x0000000000740000-0x00000000017FA000-memory.dmp	upx
behavioral2/memory/2848-114-0x0000000000B40000-0x0000000001BFA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573b73.exee575709.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e573b73.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e573b73.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575709.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e575709.exee573b73.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575709.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573b73.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e573b73.exe

description	ioc	process
File opened (read-only)	\??\J:	e573b73.exe
File opened (read-only)	\??\K:	e573b73.exe
File opened (read-only)	\??\L:	e573b73.exe
File opened (read-only)	\??\O:	e573b73.exe
File opened (read-only)	\??\S:	e573b73.exe
File opened (read-only)	\??\E:	e573b73.exe
File opened (read-only)	\??\P:	e573b73.exe
File opened (read-only)	\??\Q:	e573b73.exe
File opened (read-only)	\??\H:	e573b73.exe
File opened (read-only)	\??\R:	e573b73.exe
File opened (read-only)	\??\G:	e573b73.exe
File opened (read-only)	\??\I:	e573b73.exe
File opened (read-only)	\??\M:	e573b73.exe
File opened (read-only)	\??\N:	e573b73.exe

Drops file in Program Files directory 4 IoCs

Processes:

e573b73.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e573b73.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e573b73.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e573b73.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e573b73.exe

Drops file in Windows directory 3 IoCs

Processes:

e573b73.exee575709.exe

description ioc process

File created C:\Windows\e573bff e573b73.exe
File opened for modification C:\Windows\SYSTEM.INI e573b73.exe
File created C:\Windows\e57a577 e575709.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e573b73.exe

pid process

1640 e573b73.exe
1640 e573b73.exe
1640 e573b73.exe
1640 e573b73.exe

description	ioc	process
File created	C:\Windows\e573bff	e573b73.exe
File opened for modification	C:\Windows\SYSTEM.INI	e573b73.exe
File created	C:\Windows\e57a577	e575709.exe

pid	process
1640	e573b73.exe
1640	e573b73.exe
1640	e573b73.exe
1640	e573b73.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e573b73.exe

description	pid	process
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe
Token: SeDebugPrivilege	1640	e573b73.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

rundll32.exerundll32.exee573b73.exe

description	pid	process	target process
PID 872 wrote to memory of 1596	872	rundll32.exe	rundll32.exe
PID 872 wrote to memory of 1596	872	rundll32.exe	rundll32.exe
PID 872 wrote to memory of 1596	872	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1640	1596	rundll32.exe	e573b73.exe
PID 1596 wrote to memory of 1640	1596	rundll32.exe	e573b73.exe
PID 1596 wrote to memory of 1640	1596	rundll32.exe	e573b73.exe
PID 1640 wrote to memory of 776	1640	e573b73.exe	fontdrvhost.exe
PID 1640 wrote to memory of 780	1640	e573b73.exe	fontdrvhost.exe
PID 1640 wrote to memory of 316	1640	e573b73.exe	dwm.exe
PID 1640 wrote to memory of 2696	1640	e573b73.exe	sihost.exe
PID 1640 wrote to memory of 2716	1640	e573b73.exe	svchost.exe
PID 1640 wrote to memory of 3028	1640	e573b73.exe	taskhostw.exe
PID 1640 wrote to memory of 3508	1640	e573b73.exe	Explorer.EXE
PID 1640 wrote to memory of 3668	1640	e573b73.exe	svchost.exe
PID 1640 wrote to memory of 3864	1640	e573b73.exe	DllHost.exe
PID 1640 wrote to memory of 3956	1640	e573b73.exe	StartMenuExperienceHost.exe
PID 1640 wrote to memory of 4020	1640	e573b73.exe	RuntimeBroker.exe
PID 1640 wrote to memory of 732	1640	e573b73.exe	SearchApp.exe
PID 1640 wrote to memory of 3920	1640	e573b73.exe	RuntimeBroker.exe
PID 1640 wrote to memory of 4728	1640	e573b73.exe	TextInputHost.exe
PID 1640 wrote to memory of 4836	1640	e573b73.exe	RuntimeBroker.exe
PID 1640 wrote to memory of 872	1640	e573b73.exe	rundll32.exe
PID 1640 wrote to memory of 1596	1640	e573b73.exe	rundll32.exe
PID 1640 wrote to memory of 1596	1640	e573b73.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	e573cca.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	e573cca.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	e573cca.exe
PID 1596 wrote to memory of 2848	1596	rundll32.exe	e575709.exe
PID 1596 wrote to memory of 2848	1596	rundll32.exe	e575709.exe
PID 1596 wrote to memory of 2848	1596	rundll32.exe	e575709.exe
PID 1640 wrote to memory of 776	1640	e573b73.exe	fontdrvhost.exe
PID 1640 wrote to memory of 780	1640	e573b73.exe	fontdrvhost.exe
PID 1640 wrote to memory of 316	1640	e573b73.exe	dwm.exe
PID 1640 wrote to memory of 2696	1640	e573b73.exe	sihost.exe
PID 1640 wrote to memory of 2716	1640	e573b73.exe	svchost.exe
PID 1640 wrote to memory of 3028	1640	e573b73.exe	taskhostw.exe
PID 1640 wrote to memory of 3508	1640	e573b73.exe	Explorer.EXE
PID 1640 wrote to memory of 3668	1640	e573b73.exe	svchost.exe
PID 1640 wrote to memory of 3864	1640	e573b73.exe	DllHost.exe
PID 1640 wrote to memory of 3956	1640	e573b73.exe	StartMenuExperienceHost.exe
PID 1640 wrote to memory of 4020	1640	e573b73.exe	RuntimeBroker.exe
PID 1640 wrote to memory of 732	1640	e573b73.exe	SearchApp.exe
PID 1640 wrote to memory of 3920	1640	e573b73.exe	RuntimeBroker.exe
PID 1640 wrote to memory of 4728	1640	e573b73.exe	TextInputHost.exe
PID 1640 wrote to memory of 4836	1640	e573b73.exe	RuntimeBroker.exe
PID 1640 wrote to memory of 1088	1640	e573b73.exe	e573cca.exe
PID 1640 wrote to memory of 1088	1640	e573b73.exe	e573cca.exe
PID 1640 wrote to memory of 2848	1640	e573b73.exe	e575709.exe
PID 1640 wrote to memory of 2848	1640	e573b73.exe	e575709.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e573b73.exee575709.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573b73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575709.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:316

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2716

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3028

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Users\Admin\AppData\Local\Temp\e573b73.exe
C:\Users\Admin\AppData\Local\Temp\e573b73.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1640

C:\Users\Admin\AppData\Local\Temp\e573cca.exe
C:\Users\Admin\AppData\Local\Temp\e573cca.exe
4⤵
- Executes dropped EXE
PID:1088

C:\Users\Admin\AppData\Local\Temp\e575709.exe
C:\Users\Admin\AppData\Local\Temp\e575709.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3864

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4020

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:732

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3920

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4728

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4836

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e573b73.exe
Filesize
97KB

MD5
c255b99dff114b9250322871eca91ab9

SHA1
a72872914ccc310507e00d25d54c758e29425b16

SHA256
f474071435b341d9b856e16be8153a7bff203c8c9b9ae53c5e239b8f2ee63900

SHA512
c42732f9dc256b797fb59d02edf2f89469b7960b2b85b4f0791f29fc51cceca9f2c8e66fcf9c7f925caf33e90089cf35e4a6f6df2b6906929fc5e5d648510ee2

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
503d6332cda1d63e44575f0a12e9b21d

SHA1
b7b256f733b08aaa32e2aeafa1da771500252e62

SHA256
6f5699f8145ae56ff9bfa997815753440d47b24c7ff4ebd6ecfe0d087115b95e

SHA512
6a661d734eed13cc1801fdcf80b243eb8b425b677f49eb179aa2f7213f21402b5f75a1a23d2e35b7f0ea026fa639ac864ec4b0a9da3841fcb3192c67e19d228b

Download Submit
memory/1088-105-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1088-57-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1088-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1088-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1596-28-0x0000000003C20000-0x0000000003C22000-memory.dmp

Filesize
8KB

Download
memory/1596-16-0x0000000003C20000-0x0000000003C22000-memory.dmp

Filesize
8KB

Download
memory/1596-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1596-12-0x0000000003C20000-0x0000000003C22000-memory.dmp

Filesize
8KB

Download
memory/1596-21-0x0000000004220000-0x0000000004221000-memory.dmp

Filesize
4KB

Download
memory/1640-42-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-75-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-31-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-19-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-11-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-10-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-20-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-34-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-22-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/1640-35-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-36-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-37-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-38-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-39-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-41-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-29-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/1640-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1640-51-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-53-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-54-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-15-0x0000000003D30000-0x0000000003D31000-memory.dmp

Filesize
4KB

Download
memory/1640-6-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-83-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-91-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/1640-8-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-9-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-64-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-66-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-69-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-71-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-73-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-33-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-77-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-79-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-81-0x0000000000740000-0x00000000017FA000-memory.dmp

Filesize
16.7MB

Download
memory/1640-101-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2848-60-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2848-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2848-63-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2848-113-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2848-114-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download
memory/2848-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download