Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 00:16
Behavioral task
behavioral1
Sample
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe
-
Size
93KB
-
MD5
2a51c7228ac7bffae312e3ddc2e4bd30
-
SHA1
7557b34ed4efd62eac785fa338bbbb8a27471953
-
SHA256
ef5c701f146d3240bb634ff75c17d678d0a253357496d3d1172bb202e97e76a4
-
SHA512
ad7d6cc9e616082ed2a0db664cbd75b15fdfc10b7e4d75e3a7eef2066aeac1f48323a61fda2299d1399be3c446ac3aa2842bff7c29a11032fa2fa3de1f7faaea
-
SSDEEP
1536:mfg5XeWVhKqPaolHLzK83peDnhTpyLMjO:55XRhKqPaogbDnxMx
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\sysinfo.exe\"" 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2176-9-0x00000000001B0000-0x00000000001C5000-memory.dmp modiloader_stage2 -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Program Files\Common Files\Microsoft Shared\MSInfo\qqdsq2.lmz acprotect -
Loads dropped DLL 1 IoCs
Processes:
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exepid process 2176 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2176-0-0x0000000000400000-0x0000000000419000-memory.dmp upx \Program Files\Common Files\Microsoft Shared\MSInfo\qqdsq2.lmz upx behavioral1/memory/2176-6-0x00000000001B0000-0x00000000001C5000-memory.dmp upx behavioral1/memory/2176-8-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/2176-9-0x00000000001B0000-0x00000000001C5000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
Processes:
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\qqdsq2.lmz 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\qqdsq2.lmz 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\6hackol.com 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSINFO\6hackol.com 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\sysinfo.exe 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exepid process 2176 2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a51c7228ac7bffae312e3ddc2e4bd30_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Program Files\Common Files\Microsoft Shared\MSInfo\qqdsq2.lmzFilesize
27KB
MD55ffeaf4625ea5ce5beb8040f0b751d2c
SHA1160f8a60964d7ef2119d7d3423b29db67d4a32bd
SHA25600dee0bec73e3263601984cd96b0d7c5238a37da1200a3af367731c2857b25ae
SHA512b0b161a454e1ec05da6639d38e318fcffafebef41e8c14f929ec31f4c521462ef5e503305a3ddd479aaf4c1067ac4d29fdaf751fe61e99a220e3a4ee13a21cc9
-
memory/2176-0-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2176-6-0x00000000001B0000-0x00000000001C5000-memory.dmpFilesize
84KB
-
memory/2176-8-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2176-9-0x00000000001B0000-0x00000000001C5000-memory.dmpFilesize
84KB