Overview

overview

8

Static

static

3

a4136106fa...cs.exe

windows7-x64

8

a4136106fa...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 17:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4136106faa4cc5647d5e2c92baa8bd0_NeikiAnalytics.exe

  • Size

    86KB

  • MD5

    a4136106faa4cc5647d5e2c92baa8bd0

  • SHA1

    28690c6f9c5652bef57aefd02b9869ae04c58335

  • SHA256

    a486df087dacf03f45294ec4975955e9f208fa3a6a15c3eeb76783830ad33556

  • SHA512

    51ccbd3c4c4fd305d39e65072ebcf1d5727d04929b3f05a5622e9cba5ac68e12494872efcfdc821beff96eb26a8c1ce959c5eef2b0646c371d61b19dcb5ec955

  • SSDEEP

    768:1m/QojCpHfx08VJGHR97/RDU5naXUsukvZO5vLJASGlLdtBoKIWYkvZO5vLJASGq:EQojXbpsvkvetAV13BVYkvetAV13BVU

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 28 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4136106faa4cc5647d5e2c92baa8bd0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a4136106faa4cc5647d5e2c92baa8bd0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\AE 0124 BE.docx"
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2988
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops autorun.inf file
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\AE 0124 BE.exe
          "C:\Windows\AE 0124 BE.exe"
          3⤵
          • Drops file in Drivers directory
          • Manipulates Digital Signatures
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops desktop.ini file(s)
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2480
          • C:\Windows\SysWOW64\drivers\winlogon.exe
            "C:\Windows\System32\drivers\winlogon.exe"
            4⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2840
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      537a190888ac8fe6e0432d771de9b4d7

      SHA1

      159f2627bbb20a5f33aea7723e9a41e457ff638d

      SHA256

      9060060ebf2ce46e31fb536de5cf875aca0c1f2b1e0b4eb6b66268226f6bf742

      SHA512

      6141a3f72ec889c6f65ea762e5285d9b24db7014f78bb096721d93c74b20aa7c1a9b317625d8a6c669fe20dfc5953b5b48ecd7ec781b285227a1c0e052d699d0

      Download Submit

    • C:\Windows\AE 0124 BE.docx
      Filesize

      86KB

      MD5

      a6723e929f2b6239441b80eef8f54b50

      SHA1

      885c6bde0df35f2158905700e3a421130e0f7190

      SHA256

      b89eea7d6822cef637117340c276f50aee56188cb7552936f2c20ec31e992f37

      SHA512

      9935a2da09ff603121c61a780b3c37c9b2daf0592ec6bc7c616f11608d7c0f05e00c03465c3422c4364ee4c26129fc949aae92983f36376dcfdd440dc13411d0

      Download Submit

    • C:\Windows\Msvbvm60.dll
      Filesize

      1.3MB

      MD5

      5343a19c618bc515ceb1695586c6c137

      SHA1

      4dedae8cbde066f31c8e6b52c0baa3f8b1117742

      SHA256

      2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

      SHA512

      708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

      Download Submit

    • C:\Windows\~$ 0124 BE.docx
      Filesize

      162B

      MD5

      33d4b4b3dd1367137727152839c07bac

      SHA1

      5f46001484f7d760699c470e794ff40d5a89a997

      SHA256

      eb1f83fdedc471103a23f5ae306fa7db38e56e67e11870579e89a3b0198049d4

      SHA512

      0caad96cf3c5eaa317afa68457285ee93b0c62ebbdebeeece927cb5074b711edd7d0f05ec4e79d7c0478b73b3c51b92e6c07f94a578044a0c847bf7cbd18bbcd

      Download Submit

    • \??\c:\B1uv3nth3x1.diz
      Filesize

      25B

      MD5

      589b6886a49054d03b739309a1de9fcc

      SHA1

      0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

      SHA256

      564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

      SHA512

      4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

      Download Submit

    • \Windows\SysWOW64\drivers\winlogon.exe
      Filesize

      40KB

      MD5

      6ad88f2f49aebadae453ef04c59d7ee0

      SHA1

      ca8f3d3cb85990492a7614585d4a2568394b1c7d

      SHA256

      575586cc837fc6f57377e3a59a58dc0d0fa6e274b2c1a11ecbc5348b798a1def

      SHA512

      83bf5a5df8e87e8c9b819e3d76769ae94d8411f69dc2d3f513ca7df0a621ca9c6d5cb210b4a92ff29ecfbc66e0744e893f5bb88944fab12b5407a5389ca98c13

      Download Submit

    • memory/2480-339-0x0000000072940000-0x0000000072A93000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2480-349-0x0000000072940000-0x0000000072A93000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2652-7-0x000000002FEF1000-0x000000002FEF2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2652-12-0x000000007166D000-0x0000000071678000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2652-341-0x000000007166D000-0x0000000071678000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2652-11-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2652-368-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2652-369-0x000000007166D000-0x0000000071678000-memory.dmp

      Filesize

      44KB

      Download