Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 14:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe
-
Size
248KB
-
MD5
60fd599e3d2c3b87195b839f8a25d810
-
SHA1
4fe8f3dd8f36954aeccd82ccfc7540c594f13313
-
SHA256
f8ee6cb18fa76f204738d6a427ba1d5eb1d7f7516c03cdd7c763cd017350b79f
-
SHA512
9f13d2f60dbbbc46f0fd1ef93e7f66f476e30540ac23f38ce8c214adb2736e7e3cd7d8379bb62d32e36a510a827eb6d6ee37ca18e2b462723bd5f4790ef26fc2
-
SSDEEP
1536:Kwgu3c9YtkmU9blk81NM6MoAUK1bWYxYZ8Q6iwkSQ7A/XZKl/YWAISDKowoz/GHj:Xgu3k+Uhlk83AzxYkijDcdeDf
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neuhuur.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 308 neuhuur.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /C" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /m" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /o" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /g" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /G" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /i" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /B" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /j" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /W" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /H" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /q" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /R" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /A" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /V" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /l" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /c" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /z" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /d" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /r" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /M" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /K" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /p" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /T" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /J" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /U" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /S" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /b" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /y" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /w" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /D" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /h" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /v" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /N" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /s" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /Y" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /Z" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /f" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /O" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /a" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /E" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /t" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /Q" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /X" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /e" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /n" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /u" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /k" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /x" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /I" neuhuur.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neuhuur = "C:\\Users\\Admin\\neuhuur.exe /L" neuhuur.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe 308 neuhuur.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2992 60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe 308 neuhuur.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 308 2992 60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe 87 PID 2992 wrote to memory of 308 2992 60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe 87 PID 2992 wrote to memory of 308 2992 60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe 87 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83 PID 308 wrote to memory of 2992 308 neuhuur.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\60fd599e3d2c3b87195b839f8a25d810_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\neuhuur.exe"C:\Users\Admin\neuhuur.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD51cad7a357b19419c809843904197569e
SHA1e9d386537af89b0f1d121fb4169be1a1fd7ae3ef
SHA25683387e281dde9d714b73485feb5bf0566b14476a36f5ea372cc2fc56660f6b12
SHA5127bdb0b087e4e02def1f63c7a909cb4172acddfe16a5b8e24a2c8ea4d166d2f32df8f9d443fa6a8ff618a833f9b072277595069951813f371c3e51fad3f5b3de1