3c7346e1e562011176dcfde3456cc32cfcad4740bcf5035c3ada6720c8504bee

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Size

352KB
MD5

2cb74394d8416eb30bd17c808e325020
SHA1

af1d21c8bbdefd6243771480c89804a7de75cb6b
SHA256

3c7346e1e562011176dcfde3456cc32cfcad4740bcf5035c3ada6720c8504bee
SHA512

09fc21d2d6d93f2d6f3aaf9cd53af520ab153e42e31da64c91f015866f62f0993c6ab7c1c5657f1138d6b9e3fca813f43294691b76222dbd0757ae8e9bd22898
SSDEEP

6144:LIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:eKofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c00000001226d-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1832	ctfmen.exe
2916	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
1832	ctfmen.exe
1832	ctfmen.exe
2916	smnss.exe
2544	WerFault.exe
2544	WerFault.exe
2544	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ctfmen.exe	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\smnss.exe	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shervans.dll	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\grcopy.dll	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\satornas.dll	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	smnss.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2916	WerFault.exe	29

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1832	2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 1832	2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 1832	2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 1832	2180	2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe	28
PID 1832 wrote to memory of 2916	1832	ctfmen.exe	29
PID 1832 wrote to memory of 2916	1832	ctfmen.exe	29
PID 1832 wrote to memory of 2916	1832	ctfmen.exe	29
PID 1832 wrote to memory of 2916	1832	ctfmen.exe	29
PID 2916 wrote to memory of 2544	2916	smnss.exe	30
PID 2916 wrote to memory of 2544	2916	smnss.exe	30
PID 2916 wrote to memory of 2544	2916	smnss.exe	30
PID 2916 wrote to memory of 2544	2916	smnss.exe	30

C:\Users\Admin\AppData\Local\Temp\2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2cb74394d8416eb30bd17c808e325020_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 816
      4⤵
      Loads dropped DLL
      Program crash
      PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
641033186fcfff5d1bc98bb170214ead

SHA1
5619d65aac1bc40f9eac9ef9ec4a6b8cdb5f4632

SHA256
5cfcddfb8160e3d635036bbcfcd053d400c3f439a18bd4a3d03530c09ec0b2a0

SHA512
346364882b61e8d55423e67211360f35710b98acebe10e8089651380003b45cbe34ae8fb1bfa47923964538be9dd662e48623df9cf582d59ec15b46fdba6ffc9

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
352KB

MD5
006d98eb287b042366b061bed7a64989

SHA1
fd2fc198e9c1a39ef683acb990b5007286d6da3b

SHA256
b092b0c9b0f70d513ee66523a7467f557b5e765be95ea82a1fa8883aab5b1813

SHA512
305c336e555f694a665769f8cb313efc3c9d89e4fd1709fb6d3775d30340d9bfac000caa360cf813897a7ff2d7d5bc12448b00d816d6b362cac3da82684f492b

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
103f42bf0d1897febf0ff0a74304a243

SHA1
aed0651166fc3f78f9ea84e68e1dae484b2b2d5e

SHA256
3ff9951880346cc2dd53667cf839f838b5b8769b3b533ef052174f8d99ff940a

SHA512
fd9d89f60daea103366e9edf7099813061e718c642c16f6945df8989387c272fd1da86075e4388953004d35450ed7107f5f01ad9a048d2926c3fb6c88ca49fce

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
793667cdc5be466c03e674c8762345da

SHA1
354afdf4ef248fb82abb73c77599a4aec1d4e319

SHA256
8d24e2c3c1de75e82440af611c672b4a006d2841a489381de41f406728456106

SHA512
e3425e5de4c0d86060a753ce6216bdb0882a1a5615b70b000f7c474bbf473af59fbfb0e2e70077ba094abe09118df98e977075d8fe61ed19dfc101643abd36b0

Download Submit
memory/1832-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2180-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2180-18-0x0000000000340000-0x0000000000349000-memory.dmp

Filesize
36KB

Download
memory/2180-26-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2180-16-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2180-25-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2916-35-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2916-41-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2916-47-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads