03375e340a0952503e01983f8f907c7df6c823bcf252226d548f81c415b59b98

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe
Size

119KB
MD5

30206f83cdf73b5ed6f82744498f6690
SHA1

3110d2be8e4db93f66d3e6a8c6d6ad5118fbf9af
SHA256

03375e340a0952503e01983f8f907c7df6c823bcf252226d548f81c415b59b98
SHA512

3b861a02808782ac59ff6f93e521aa10a628c3c834274b431dae55e0c0f4e8f692a05f3d71c025983ed996006184b4eb72f631768ced5649d5e62f7aee3b8f64
SSDEEP

3072:OE9j8b3ZXgKC1hX//iASOXRJzDOD26j/3Dcl:OEebiKuX//iZOXRJ3OD26jc

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1916	smss.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1230\smss.exe	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\1230\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\Service.exe	smss.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3468	sc.exe
3524	sc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe
1916	smss.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 3468	2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe	91
PID 2196 wrote to memory of 3468	2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe	91
PID 2196 wrote to memory of 3468	2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe	91
PID 2196 wrote to memory of 1916	2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe	93
PID 2196 wrote to memory of 1916	2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe	93
PID 2196 wrote to memory of 1916	2196	30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe	93
PID 1916 wrote to memory of 3524	1916	smss.exe	94
PID 1916 wrote to memory of 3524	1916	smss.exe	94
PID 1916 wrote to memory of 3524	1916	smss.exe	94

C:\Users\Admin\AppData\Local\Temp\30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\30206f83cdf73b5ed6f82744498f6690_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe stop wscsvc
  2⤵
  - Launches sc.exe
  PID:3468
- C:\Windows\SysWOW64\1230\smss.exe
  C:\Windows\system32\1230\smss.exe -d
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe stop wscsvc
    3⤵
    - Launches sc.exe
    PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3672,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:8
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\1230\smss.exe

Filesize
119KB

MD5
36d00695447518096c90f5ed2f7c1b1f

SHA1
3693997f5c3f211091d65f9191793fc677661f57

SHA256
2e4a1b115f0d5b0af6c01388e080effe0dd8f890b86b57ec31fdac5ac955ab9c

SHA512
2c4f3a969a218b0ee550eb45e1630737bcab64cba0b695378260d1039820f0e5ff291571fe50f4200da327742920f86a2f20c15231c4eeef9c471d707ed40e53

Download Submit
memory/2196-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download