20863dec1e95aba20210faee3eb6f60d3f104c35159584192d2a4a56829abee3

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe
Size

135KB
MD5

01f9a263b64defb7fb9ae2775f7cee00
SHA1

da427f5190e2dc98e7796bf54de1b3e244c89191
SHA256

20863dec1e95aba20210faee3eb6f60d3f104c35159584192d2a4a56829abee3
SHA512

73dd8f21f111444d27af7c46efee2db6f2cfd2d3dc7872ee8957c134c653f1452c365db1ce72cc8e1b28de13e590b4d9212d34c0779991487fef038cfe2bae49
SSDEEP

3072:NatP0KLc3VsweCeXRzeSeVeEe0eDQ8jrTrq:wJc3VsZR3Q8jrTr

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vofed.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	vofed.exe

Loads dropped DLL 2 IoCs

pid	Process
2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe
2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\vofed = "C:\\Users\\Admin\\vofed.exe"	vofed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe
2392	vofed.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe
2392	vofed.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2392	2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe	28
PID 2912 wrote to memory of 2392	2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe	28
PID 2912 wrote to memory of 2392	2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe	28
PID 2912 wrote to memory of 2392	2912	01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe	28
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27
PID 2392 wrote to memory of 2912	2392	vofed.exe	27

C:\Users\Admin\AppData\Local\Temp\01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\01f9a263b64defb7fb9ae2775f7cee00_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\vofed.exe
  "C:\Users\Admin\vofed.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\vofed.exe

Filesize
135KB

MD5
2de0e3257df09d1b815e2bc99f90090a

SHA1
bc015191007678896eea248bf022a3067ae826f3

SHA256
a51986172199131419bba4e3267d72a56e3eb1cdd78e0fdb25736dc6ac3aa834

SHA512
b5a6768eab5887eb42c118d574a04e50584513d4f289028ae9a5580d33ae722b26c31b630001469d56b1066d2831f0f1b74d4df9fa906dcaa52ba3204dd57a1a

Download Submit