Analysis
- max time kernel
136s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 10:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe
- Size 118KB
- Sample240509-mvt7eade9w
- SHA256 b23d7cf2abe1666d8a2382e1dd66e9578b57b5fcdd04332231ac35bfec2add91
- MD5 16d807f09b7ee35dc3fc899e8ade0b20
- SHA1 b95571556abb6a18a6138d52732fc48bedfe9016
- SHA512 e91d71bdef2734f8f4c5eefed95e24c8e6dc5a6dd525f3f72dece370c91f850db10ba2451a7ab601c305af9222db88d8ff79ba060f5ecb55b81c5fe530e069f3
- SSDEEP 3072:FOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPo:FIs9OKofHfHTXQLzgvnzHPowYbvrjD/h
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023417-10.dat acprotect - Executes dropped EXE 2 IoCs
pid Process 2336 ctfmen.exe 4200 smnss.exe - Loads dropped DLL 2 IoCs
pid Process 1076 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe 4200 smnss.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe - Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\grcopy.dll 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\smnss.exe 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\satornas.dll 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shervans.dll 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\grcopy.dll 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\History.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml smnss.exe File opened for modification C:\Program Files\dotnet\ThirdPartyNotices.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt smnss.exe File opened for modification C:\Program Files\7-Zip\readme.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml smnss.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1364 4200 WerFault.exe 92 - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4200 smnss.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2336 1076 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe 91 PID 1076 wrote to memory of 2336 1076 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe 91 PID 1076 wrote to memory of 2336 1076 16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe 91 PID 2336 wrote to memory of 4200 2336 ctfmen.exe 92 PID 2336 wrote to memory of 4200 2336 ctfmen.exe 92 PID 2336 wrote to memory of 4200 2336 ctfmen.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\16d807f09b7ee35dc3fc899e8ade0b20_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 14804⤵
- Program crash
PID:1364
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4200 -ip 42001⤵PID:836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ctfmen.exe
- Size 4KB
- SHA256 15cebfe94a6ec52e0d396efac7a52bea37da65c5c0a193f1f358f3d903a23bec
- MD5 f1d3b40614ba6343529d7a3aae295efa
- SHA1 af505b229a695a1c26b886bc55cfdcbc27292b45
- SHA512 4340778a25a50a684d47ab0b3966077cf194234024564a81013e6ad1a4c6452922e22fe05c53c7fd89ab053f1ff3d4649a6a7a4b419f970db8d6608be5d0fe2d
- SSDEEP 96:LaIdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:mswdRCNCE8YPWowHHK7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\grcopy.dll
- Size 118KB
- SHA256 01e1e9f7cd1a45704b78f78f1c758deac51c9956dd96bfdb7eb8e0d32fb08b14
- MD5 8221a356d91df8b6f817be283ff14cf5
- SHA1 ac95018766c84ec327f8bcb7accf2cfdbfb9f8f7
- SHA512 2ba955b0628f28610d91c07f0602b632dcfaed60e01870b0d3bd942f2bb58408c957d3cb5dac77c002cb547e8e9691ebee32cde2106bde21e14679f285adc56f
- SSDEEP 3072:2OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPo:2Is9OKofHfHTXQLzgvnzHPowYbvrjD/h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\satornas.dll
- Size 183B
- SHA256 1a838a5f8a21a7bd288162f8e6a6136e4c6eaaefe1a2df557add0c47641bdc48
- MD5 739b278ba686c7d1af59f9a2b1c65692
- SHA1 bea401a07d80f6ea4b0861a4a92a38a0f718a8d4
- SHA512 16fb810ed8741f0c8f9f9f294167aef7e2adc45a393592ce5ed67004be9b8c5c4dace92f07d733f19226716363aa6df4e80c703d7ec8f2601345b86fc4d9185f
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\shervans.dll
- Size 8KB
- SHA256 570e1a45fefe86c7bf1ac0066acb0c78f5e865928fa2cfe951609598bbff7a2a
- MD5 4ac9a0f48309486a0cfdcdbbabe76055
- SHA1 5eccb442c87550a3074be2266c00059d89834698
- SHA512 5d558d2b9ffa24df02ade43af1eecbb4cb3df716b1d486fb6fcd2f802e64c4bb9c4274a5fd9e51258733a813a271fb6dc5bcd6cffbf4146bda9884022c827489
- SSDEEP 192:Mh4SFyvWohE5xf6YUBSL63SUJqtMblWN:MO+ohE2B13NJqtM
- MD5 SHA1 SHA512 SSDEEP