Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 23:05
Behavioral task
behavioral1
Sample
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe
-
Size
130KB
-
MD5
25a0e1ddaf2ea2651c5d003e5bb46e90
-
SHA1
10327cff73d617f16acec8ab069d3248d5528de6
-
SHA256
66315abf3b931779a783273fa5e6359fec0e67041b2b395956927864c551c886
-
SHA512
d3d7d6b6c6e5e17f2c832722832ce97e70dc32791f2d756c28e3b1755d456dae1640923336d6b04382dce87af6ea430d75cf640c74698136575184fc6554dbc4
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZN:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKf
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1932-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1932-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1932-48-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1932-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1932-60-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1932-62-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 1652 Flaseher.exe 2028 Flaseher.exe 1932 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/3860-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4920-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4920-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3860-13-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4920-12-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/1652-37-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1652-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1652-41-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1652-55-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4920-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4920-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1652-44-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2028-61-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 3860 set thread context of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 1652 set thread context of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 set thread context of 1932 1652 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe Token: SeDebugPrivilege 2028 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 1652 Flaseher.exe 2028 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 3860 wrote to memory of 4920 3860 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe PID 4920 wrote to memory of 1788 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe cmd.exe PID 4920 wrote to memory of 1788 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe cmd.exe PID 4920 wrote to memory of 1788 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe cmd.exe PID 1788 wrote to memory of 3176 1788 cmd.exe reg.exe PID 1788 wrote to memory of 3176 1788 cmd.exe reg.exe PID 1788 wrote to memory of 3176 1788 cmd.exe reg.exe PID 4920 wrote to memory of 1652 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe Flaseher.exe PID 4920 wrote to memory of 1652 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe Flaseher.exe PID 4920 wrote to memory of 1652 4920 25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 2028 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe PID 1652 wrote to memory of 1932 1652 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\25a0e1ddaf2ea2651c5d003e5bb46e90_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JTMLN.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\JTMLN.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD5871f70e324bfd1b11205522d5ba10e0b
SHA1c3536ebed9858babef899f04c27fba448c301b0a
SHA256d0b574f7f3e87fa53ff0b101a7f5ab6ddfe7b324bc36ff9cd646e2e0a0f17110
SHA512443ea551689f3459071fc4a66cab941771f2fece8f5fff078344be4f361ca48061a27ae1037d819c504231d3714fdfcbf1cff27626723ba44410621a017789ac
-
memory/1652-44-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1652-55-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1652-41-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1652-40-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1652-37-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1932-48-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1932-51-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1932-59-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1932-62-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1932-60-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1932-53-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2028-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3860-10-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/3860-3-0x0000000002960000-0x0000000002961000-memory.dmpFilesize
4KB
-
memory/3860-7-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/3860-6-0x0000000002A00000-0x0000000002A01000-memory.dmpFilesize
4KB
-
memory/3860-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3860-4-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/3860-5-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/3860-13-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4920-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4920-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4920-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4920-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4920-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB