Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 17:00
Behavioral task
behavioral1
Sample
9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe
-
Size
302KB
-
MD5
9c182cfc916eeb5808e25cf103927ea0
-
SHA1
3e2ae5b1f24101a65ba7d8a07e3cea4e007e2e6c
-
SHA256
12edcb4729c6e9b01bf51b219b3941ee31c25e7b10d2a6755385ed0b5446a57e
-
SHA512
2f1e9c5811d3d7a418011d7765f96d86fa2de8448e8e71f2d230fce23e5ed301b62a3a71838e930bf50d2274fbbf2ec33401bc797ce926b1ee3cc1717677d93b
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYm:v6Wq4aaE6KwyF5L0Y2D1PqLr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1964 svhost.exe -
resource yara_rule behavioral1/memory/2080-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000b00000001444f-4.dat upx behavioral1/memory/1964-5-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x0007000000014b12-66.dat upx behavioral1/memory/2080-802-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-1323-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-2384-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-3445-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-4762-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-5819-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-6882-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-7941-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-9260-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-10322-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-11381-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-12436-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-13762-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-14821-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1964-15878-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2080-802-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-1323-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-2384-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-3445-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-4762-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-5819-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-6882-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-7941-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-9260-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-10322-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-11381-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-12436-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-13762-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-14821-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1964-15878-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1964 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe 1964 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1964 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1964 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1964 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1964 2080 9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c182cfc916eeb5808e25cf103927ea0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD5948ffcd743b7451876a133b3b65fb4a2
SHA1d52acd8d321d02bc8e25c2687610bc259f7db7cb
SHA256f7ea5469e6e6fe417812de0453926ee2316f532f72f4084235626e95c34f98d8
SHA512d009578a453c83ec82a70d5e825636d2216141595b4a482db78a62774e0237e6ac14b941245b01dbf3c82c2b42938500b15333fc4650ed15b632d7964e8cda33
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
302KB
MD5c57902e84a25c890bb4994d0d741b753
SHA143c3632274462760fb67bd871359e5363a63b4e9
SHA256f7932b50648457c7d0f45f8b1f950dbff1258a256e22f9b1448ddee1eafa6655
SHA51231b85fe15778ce686e9a23e8530ff0a61248b6b128be0b04a5b61d957b3ae616c13cb6a8edb7b2cc3852154958aeed53e76ef9df7da3a9dc2a4c4a5ea2f5261c