a1246d7dfd60dd8792d08c54a22734911f797e44d3eecab7bae097d5de25d84b

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe
Size

69KB
MD5

ded99cdee27b69b6aaf95bc58391f0b0
SHA1

900d841290d25f0a1d095ef48594682b6570e939
SHA256

a1246d7dfd60dd8792d08c54a22734911f797e44d3eecab7bae097d5de25d84b
SHA512

dedffbe41a200ff7d6b00aab58382bce5fda19a494cad3e060c1324a5cfd8586ad395325f9d2d6b556e9bef4ddc38a3286c64116cf18eea74c4ebdd9b318161e
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8J:Olg35GTslA5t3/w8J

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	idratat-omur.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\IsInstalled = "1"	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\StubPath = "C:\\Windows\\system32\\epconed-ucex.exe"	idratat-omur.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\etcudib-ateab.exe"	idratat-omur.exe

Executes dropped EXE 2 IoCs

pid	Process
4632	idratat-omur.exe
724	idratat-omur.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	idratat-omur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	idratat-omur.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	idratat-omur.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ukgahean-oucac.dll"	idratat-omur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	idratat-omur.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\etcudib-ateab.exe	idratat-omur.exe
File created	C:\Windows\SysWOW64\etcudib-ateab.exe	idratat-omur.exe
File opened for modification	C:\Windows\SysWOW64\epconed-ucex.exe	idratat-omur.exe
File created	C:\Windows\SysWOW64\epconed-ucex.exe	idratat-omur.exe
File opened for modification	C:\Windows\SysWOW64\ukgahean-oucac.dll	idratat-omur.exe
File created	C:\Windows\SysWOW64\ukgahean-oucac.dll	idratat-omur.exe
File opened for modification	C:\Windows\SysWOW64\idratat-omur.exe	ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\idratat-omur.exe	ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\idratat-omur.exe	idratat-omur.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
724	idratat-omur.exe
4632	idratat-omur.exe
724	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe
4632	idratat-omur.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4632	idratat-omur.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4632	3372	ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe	91
PID 3372 wrote to memory of 4632	3372	ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe	91
PID 3372 wrote to memory of 4632	3372	ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe	91
PID 4632 wrote to memory of 724	4632	idratat-omur.exe	92
PID 4632 wrote to memory of 724	4632	idratat-omur.exe	92
PID 4632 wrote to memory of 724	4632	idratat-omur.exe	92
PID 4632 wrote to memory of 612	4632	idratat-omur.exe	5
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57
PID 4632 wrote to memory of 3380	4632	idratat-omur.exe	57

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3380
- C:\Users\Admin\AppData\Local\Temp\ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\ded99cdee27b69b6aaf95bc58391f0b0_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\idratat-omur.exe
    "C:\Windows\system32\idratat-omur.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\SysWOW64\idratat-omur.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=764 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\epconed-ucex.exe

Filesize
71KB

MD5
67d84d7d2b8a1eda51e711dc1950360b

SHA1
4ce5a1c41c99c9b2acc6d0aa89f23a74d11cb6d6

SHA256
1c92469f293b8a8a56694756ba62fcec4f2b8a4b86f9b7f313bd9201b4ee9231

SHA512
8801ecc4964f40845e2499b3f9faa61c7cdd6ec21f9205882764def18edfd7f0e501328ab05b5f87a50c6fe23e018880dd567d52c84e04f490be5c3960afe5d2

Download Submit
C:\Windows\SysWOW64\etcudib-ateab.exe

Filesize
72KB

MD5
8e1d79a3a0b1e45c41b090b02425a05a

SHA1
6fd8af35e34e56b892a8d132dd772dce750ab842

SHA256
dcc8300f5dd6b99634283734281fc11d5468befcb4d55061c899045bdf2195ca

SHA512
31eb277dc932f5cb369081bae1a0b5428f869c9137a996a047cbb344ca5aff6c35b9fa3657aeecfd46ae51f5d25132b6f677f5ee1ca7125f0ddc8a72e91106ff

Download Submit
C:\Windows\SysWOW64\idratat-omur.exe

Filesize
69KB

MD5
ded99cdee27b69b6aaf95bc58391f0b0

SHA1
900d841290d25f0a1d095ef48594682b6570e939

SHA256
a1246d7dfd60dd8792d08c54a22734911f797e44d3eecab7bae097d5de25d84b

SHA512
dedffbe41a200ff7d6b00aab58382bce5fda19a494cad3e060c1324a5cfd8586ad395325f9d2d6b556e9bef4ddc38a3286c64116cf18eea74c4ebdd9b318161e

Download Submit
C:\Windows\SysWOW64\ukgahean-oucac.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
memory/724-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3372-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4632-46-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download