Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 21:50
Static task
static1
Behavioral task
behavioral1
Sample
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe
-
Size
308KB
-
MD5
0747a5600b67c79e18137d80b13fa4a0
-
SHA1
ccaa67e06d653747d8da29865550fb9fb9b304c9
-
SHA256
92ec93518a391b14c4a6f57fecaba0f4940745eae3faec3942d0cc74491a94bd
-
SHA512
6fc4a183641505a498b984cf38e76bfd1afda2a87e3ad75d6c99dc566a21720db73772783a64b982680ff8983681661ca9893f20faa66f76a83eb492bb670b1b
-
SSDEEP
3072:/c3sBG7mXh7m/zZM3jAbNOM6CNtDCZFL:E3sBz0Z4Mj72F
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5088-51-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5088-50-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5088-52-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/5088-58-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 4640 csrsll.exe 2096 csrsll.exe 5088 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/2884-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2884-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2884-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2096-41-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5088-49-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5088-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5088-50-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5088-44-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/5088-52-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2884-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2096-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5088-58-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.execsrsll.exedescription pid process target process PID 744 set thread context of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 4640 set thread context of 2096 4640 csrsll.exe csrsll.exe PID 4640 set thread context of 5088 4640 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe Token: SeDebugPrivilege 2096 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.execsrsll.execsrsll.exepid process 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 4640 csrsll.exe 2096 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 744 wrote to memory of 2884 744 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe PID 2884 wrote to memory of 4684 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe cmd.exe PID 2884 wrote to memory of 4684 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe cmd.exe PID 2884 wrote to memory of 4684 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe cmd.exe PID 4684 wrote to memory of 3316 4684 cmd.exe reg.exe PID 4684 wrote to memory of 3316 4684 cmd.exe reg.exe PID 4684 wrote to memory of 3316 4684 cmd.exe reg.exe PID 2884 wrote to memory of 4640 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe csrsll.exe PID 2884 wrote to memory of 4640 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe csrsll.exe PID 2884 wrote to memory of 4640 2884 0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 2096 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe PID 4640 wrote to memory of 5088 4640 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0747a5600b67c79e18137d80b13fa4a0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WJNJG.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:3316 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2096 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WJNJG.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
308KB
MD505c9b79eca08b6dc978ced48c0156601
SHA1d4a01bcc9af38926d1374d82f7ff9a784fb0de3c
SHA256fdbd47444c879158baf8a5b010ebe2fe1ff59b2250034c6c1be97e478ce2fd5b
SHA512a6e285d2f544edb3c2ae6fd942e7db9a3d3d303daa1437bf133cb0e5710bc038bca452396923f41d32141adff0d543ef936eb184c96069e40c670a5110d74f27
-
memory/744-3-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/744-5-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/744-4-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/744-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2096-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2096-41-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2884-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2884-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2884-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2884-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4640-36-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4640-53-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4640-33-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/5088-51-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5088-50-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5088-44-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5088-52-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5088-49-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5088-58-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB