34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Size

94KB
MD5

b63dd4500e4c3cb57f9b72a7247aeda0
SHA1

77710e9b78d000b9b66ff56a5650ae283f488b0f
SHA256

34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd
SHA512

e2064e8a4b8497bb740a16f749d31494bbf11e627fbd0015922f3147c87d3b278aabcfb3b6dac928ead5b0fd31fbc944250edbaf72ace1d052c1cc1de1edaebf
SSDEEP

1536:qgWMe+QIezX6y6IaK8nt/7JEo/2LmaIZTJ+7LhkiB0MPiKeEAgv:T7edIezX6y6IaK8nZJ7EmaMU7uihJ5v

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Ihoafpmp.exeIoijbj32.exe34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihoafpmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihoafpmp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioijbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioijbj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

Ihoafpmp.exeIoijbj32.exeIagfoe32.exe

pid process

2136 Ihoafpmp.exe
1044 Ioijbj32.exe
2732 Iagfoe32.exe

pid	process
2136	Ihoafpmp.exe
1044	Ioijbj32.exe
2732	Iagfoe32.exe

Loads dropped DLL 10 IoCs

Processes:

34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exeIhoafpmp.exeIoijbj32.exeWerFault.exe

pid	process
1216	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
1216	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
2136	Ihoafpmp.exe
2136	Ihoafpmp.exe
1044	Ioijbj32.exe
1044	Ioijbj32.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe
2768	WerFault.exe

Drops file in System32 directory 9 IoCs

Processes:

34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exeIhoafpmp.exeIoijbj32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Amammd32.dll	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Ioijbj32.exe	Ihoafpmp.exe
File opened for modification	C:\Windows\SysWOW64\Ioijbj32.exe	Ihoafpmp.exe
File created	C:\Windows\SysWOW64\Gjenmobn.dll	Ioijbj32.exe
File opened for modification	C:\Windows\SysWOW64\Iagfoe32.exe	Ioijbj32.exe
File created	C:\Windows\SysWOW64\Ihoafpmp.exe	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ihoafpmp.exe	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Dgnijonn.dll	Ihoafpmp.exe
File created	C:\Windows\SysWOW64\Iagfoe32.exe	Ioijbj32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2768 2732 WerFault.exe

pid	pid_target	process
2768	2732	WerFault.exe

Modifies registry class 12 IoCs

Processes:

Ihoafpmp.exeIoijbj32.exe34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihoafpmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgnijonn.dll"	Ihoafpmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ioijbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amammd32.dll"	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihoafpmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioijbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjenmobn.dll"	Ioijbj32.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exeIhoafpmp.exeIoijbj32.exeIagfoe32.exe

description	pid	process	target process
PID 1216 wrote to memory of 2136	1216	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe	Ihoafpmp.exe
PID 1216 wrote to memory of 2136	1216	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe	Ihoafpmp.exe
PID 1216 wrote to memory of 2136	1216	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe	Ihoafpmp.exe
PID 1216 wrote to memory of 2136	1216	34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe	Ihoafpmp.exe
PID 2136 wrote to memory of 1044	2136	Ihoafpmp.exe	Ioijbj32.exe
PID 2136 wrote to memory of 1044	2136	Ihoafpmp.exe	Ioijbj32.exe
PID 2136 wrote to memory of 1044	2136	Ihoafpmp.exe	Ioijbj32.exe
PID 2136 wrote to memory of 1044	2136	Ihoafpmp.exe	Ioijbj32.exe
PID 1044 wrote to memory of 2732	1044	Ioijbj32.exe	Iagfoe32.exe
PID 1044 wrote to memory of 2732	1044	Ioijbj32.exe	Iagfoe32.exe
PID 1044 wrote to memory of 2732	1044	Ioijbj32.exe	Iagfoe32.exe
PID 1044 wrote to memory of 2732	1044	Ioijbj32.exe	Iagfoe32.exe
PID 2732 wrote to memory of 2768	2732	Iagfoe32.exe	WerFault.exe
PID 2732 wrote to memory of 2768	2732	Iagfoe32.exe	WerFault.exe
PID 2732 wrote to memory of 2768	2732	Iagfoe32.exe	WerFault.exe
PID 2732 wrote to memory of 2768	2732	Iagfoe32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\34b5062f1cfc5476622b0bcd4e7f299b70dcbe74199ba812f8660ab3f6b292cd_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\Ihoafpmp.exe
C:\Windows\system32\Ihoafpmp.exe
2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\Ioijbj32.exe
C:\Windows\system32\Ioijbj32.exe
3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\Iagfoe32.exe
C:\Windows\system32\Iagfoe32.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 140
5⤵
- Loads dropped DLL
- Program crash
PID:2768

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ihoafpmp.exe
Filesize
94KB

MD5
4341938630628b19b5fc43ebf9a8f13a

SHA1
ed6657bbe273363d146b733099e0a14d143a091c

SHA256
0c3f85107814a522ded98a6996c44884b1121d2e40cc7171853a5fedb674eacc

SHA512
6bd0ce4a754ad7360a1aec0afd33ae514b77cf5497709465f9aa03a1807ddf3234a2cf8c90aba624c1972542cd60e47ac2f80349d7b91dc88d3f4161036aecfb

Download Submit
C:\Windows\SysWOW64\Ioijbj32.exe
Filesize
94KB

MD5
5a44c0726d24cb27fb79f77411e4c8c3

SHA1
28c0df828639967ac1eae5a2b39f13e1d4f47275

SHA256
021c89c2c2108e554c9168770e325bfb976229de88ae4313a86bd99c8d208223

SHA512
2cae22fd361cc15fdb349e23b54f126b157af8ddfcf6f3309bf555ebc9775f8d1f9df7e7988b62b614aff4f6cecf8c990143a70cc5eee283a7e7d6d32cc5c77c

Download Submit
\Windows\SysWOW64\Iagfoe32.exe
Filesize
94KB

MD5
2756e37c6ca61dfd335a837b45f0ac52

SHA1
bd78fa2a96da4bc79a09436b640715416b49dd9f

SHA256
201743b791a209d2de09779278147749c1fcdae43493cee2ac1b331e6dd0ee1c

SHA512
69405fa822fe33970e7fa270d1223cb066c3744879cdbabf4da44f96854dcc6f3bc4afa90795de45ff475ace337d877b906ce8c842099858e9c9b99c8549a761

Download Submit
memory/1044-28-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1044-48-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1216-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1216-12-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/1216-6-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/1216-46-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2136-27-0x00000000002E0000-0x000000000031C000-memory.dmp

Filesize
240KB

Download
memory/2136-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2136-47-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2732-41-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads