Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 02:07
Static task
static1
Behavioral task
behavioral1
Sample
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe
-
Size
208KB
-
MD5
4f34a63929f5227597ed803621ca2fb0
-
SHA1
67d7a1b72be2698d506625384a3a73c668f97ab1
-
SHA256
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f
-
SHA512
b4438b7b877ab00f3c0b126d0a950b5b8d945a9c980a103790fd775128cedef0e916dd15ebf4ddc8e8ec0a17abbc5ef83e460bbc3102ac3ff4917cae40f596a0
-
SSDEEP
3072:vwKA7xsI+OmwClcHKj4ap+r3TBcI1AKIp3wWSochZBmGz3nNbhuwTJ6:IKxI+OmwwVkDTBcypImdhZB5ZMwI
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2240-6-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-12-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-11-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-13-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-10-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-9-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-7-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-8-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-2-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-31-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-32-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-33-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-34-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-35-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-37-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-38-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-40-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-42-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-44-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-50-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-52-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-55-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-56-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-58-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-60-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-62-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-65-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-67-0x0000000002500000-0x000000000358E000-memory.dmp upx behavioral1/memory/2240-69-0x0000000002500000-0x000000000358E000-memory.dmp upx -
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\I: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\L: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\S: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\Z: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\H: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\U: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\W: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\Y: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\E: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\M: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\O: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\Q: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\T: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\J: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\K: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\N: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\P: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\V: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\X: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened (read-only) \??\G: 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification F:\autorun.inf 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Drops file in Program Files directory 9 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exepid process 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exepid process 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe Token: SeDebugPrivilege 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exepid process 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription pid process target process PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 380 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe csrss.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 388 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe wininit.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 428 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe winlogon.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 472 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe services.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 488 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsass.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 496 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe lsm.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 596 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 672 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 748 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe PID 2240 wrote to memory of 812 2240 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2d91c1bba7ac6b651abb7fbad24aa41175d541480a0efb75a2937b0845bd629f_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\winaonl.exeFilesize
97KB
MD59667c5f1435f71daea031ef076cb38dc
SHA12c5515d8f16dc02ea071e5c6b7c4421b5bb97ded
SHA256af989e3e1150f611e8f0cc808e5c2a18447767a06afd1b7a0f071104af7999bb
SHA512a2c3dc0cf3147b9c0e446cd1e39055ad9ef548a0a3d6dddba731040ff437d56783dde4c5b9e5e01cf07b175b8b44190813802e7cb1ad8654dd56d8a98089417f
-
memory/1096-14-0x0000000002070000-0x0000000002072000-memory.dmpFilesize
8KB
-
memory/2240-33-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-4-0x000000007781F000-0x0000000077820000-memory.dmpFilesize
4KB
-
memory/2240-28-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2240-27-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2240-11-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-13-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-10-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-9-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2240-8-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-26-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2240-24-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2240-23-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2240-6-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-3-0x0000000077820000-0x0000000077821000-memory.dmpFilesize
4KB
-
memory/2240-2-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-31-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-32-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-7-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-12-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-44-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-37-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-38-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-40-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-42-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-35-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-50-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-52-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-55-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-56-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-58-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-60-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-62-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-65-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-67-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-69-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-34-0x0000000002500000-0x000000000358E000-memory.dmpFilesize
16.6MB
-
memory/2240-96-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB