63566f23c62648c5aa17280b8960ddba7c6850e5759f1352435f166c7de07dd3

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
Size

71KB
MD5

c9366082abf4d6f6e646ab03c5959d20
SHA1

d4f8dbdffc5477e041191f1fc3970cad84003d95
SHA256

63566f23c62648c5aa17280b8960ddba7c6850e5759f1352435f166c7de07dd3
SHA512

494c09832fa2cfe8b74c2e5c850016246210b03ab9f4ca4930179fd945c78cf0cc76fbcd974510a6023b5f0b8d2f17d9aeed9b86c1d4b8738d360fb49c75e784
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slc:Olg35GTslA5t3/w8H

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	obbesob-eamom.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\IsInstalled = "1"	obbesob-eamom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\StubPath = "C:\\Windows\\system32\\adsigac.exe"	obbesob-eamom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}	obbesob-eamom.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	obbesob-eamom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	obbesob-eamom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oulpaxar.exe"	obbesob-eamom.exe

Executes dropped EXE 2 IoCs

pid	Process
2028	obbesob-eamom.exe
2980	obbesob-eamom.exe

Loads dropped DLL 3 IoCs

pid	Process
2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
2028	obbesob-eamom.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	obbesob-eamom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	obbesob-eamom.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	obbesob-eamom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	obbesob-eamom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\aklukear.dll"	obbesob-eamom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	obbesob-eamom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	obbesob-eamom.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\obbesob-eamom.exe	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\oulpaxar.exe	obbesob-eamom.exe
File created	C:\Windows\SysWOW64\adsigac.exe	obbesob-eamom.exe
File opened for modification	C:\Windows\SysWOW64\aklukear.dll	obbesob-eamom.exe
File opened for modification	C:\Windows\SysWOW64\obbesob-eamom.exe	obbesob-eamom.exe
File created	C:\Windows\SysWOW64\obbesob-eamom.exe	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\oulpaxar.exe	obbesob-eamom.exe
File opened for modification	C:\Windows\SysWOW64\adsigac.exe	obbesob-eamom.exe
File created	C:\Windows\SysWOW64\aklukear.dll	obbesob-eamom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2980	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe
2028	obbesob-eamom.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
Token: SeDebugPrivilege	2028	obbesob-eamom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2028	2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 2028	2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 2028	2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 2028	2032	c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe	28
PID 2028 wrote to memory of 432	2028	obbesob-eamom.exe	5
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 2980	2028	obbesob-eamom.exe	29
PID 2028 wrote to memory of 2980	2028	obbesob-eamom.exe	29
PID 2028 wrote to memory of 2980	2028	obbesob-eamom.exe	29
PID 2028 wrote to memory of 2980	2028	obbesob-eamom.exe	29
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21
PID 2028 wrote to memory of 1196	2028	obbesob-eamom.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\c9366082abf4d6f6e646ab03c5959d20_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\obbesob-eamom.exe
    "C:\Windows\system32\obbesob-eamom.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\obbesob-eamom.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\adsigac.exe

Filesize
73KB

MD5
5429fd8d46497241030af0030235163a

SHA1
44cb7e75f79955548afef68d2d9b7634f4656e59

SHA256
d9ca47783b8210088cc2d3a0caafd7ad522136317dbda6ea9b33a90bcf17ed30

SHA512
7fc0c93c6a665f339b8d62cc8881d957e2cf1e30cefd8f7ef5a8cef623c15c5b554bf8e94c6423d3d344b81db8aab13c0face5f4e0b7f3b40f63836140f3bb21

Download Submit
C:\Windows\SysWOW64\aklukear.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\oulpaxar.exe

Filesize
74KB

MD5
4a0ad68e0132a017fd939bad58860317

SHA1
e8556c1358d5d8e02b6c42af56e864dcf281c154

SHA256
6c1f9300877a22d6e9d6001c9120ca76f19cd51cd50685e96587e3a275a0f67b

SHA512
8722bd2db9bfaed2aa6ee6a1d7173d764a5c0570da9e05dd06d5bf648bdffefcaea2ff8ebac6a71e9097cd777634d32a4b20f93402003fe65b4607e0071ec3ce

Download Submit
\Windows\SysWOW64\obbesob-eamom.exe

Filesize
71KB

MD5
c9366082abf4d6f6e646ab03c5959d20

SHA1
d4f8dbdffc5477e041191f1fc3970cad84003d95

SHA256
63566f23c62648c5aa17280b8960ddba7c6850e5759f1352435f166c7de07dd3

SHA512
494c09832fa2cfe8b74c2e5c850016246210b03ab9f4ca4930179fd945c78cf0cc76fbcd974510a6023b5f0b8d2f17d9aeed9b86c1d4b8738d360fb49c75e784

Download Submit
memory/2028-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2032-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2980-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download