Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 02:45
Behavioral task
behavioral1
Sample
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe
-
Size
72KB
-
MD5
5f9067b15272efe16e3d65470ba47980
-
SHA1
bec04efe075fd29bcdba9ceefc55e18466555fae
-
SHA256
080cea8881adc3df47de80107238a1d4aed2c1d57307c93a71636e5be4e4fae6
-
SHA512
391b37701b00f17598513985f57bf8c9f6666674bb2a5beabbc5f41d9f0eab7fe9a34d0a3d6106e5e9bd1c428d2125cc435d762c6e23d9cc7f385366ba36d04c
-
SSDEEP
1536:DOa2kZ+qcAGVRIcUjmTeyovQe1RLP0sLJtoz9ZDu7GOXTm:DOYZTBORVUjtvR1L96BSXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4232-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4232-46-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4232-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4232-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4232-56-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4232-63-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 1752 Flaseher.exe 4676 Flaseher.exe 4232 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/3004-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3580-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3580-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3580-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3004-14-0x0000000000400000-0x0000000000422000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/1752-36-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1752-40-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1752-41-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1752-58-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4676-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1752-45-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3580-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4676-62-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 3004 set thread context of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 1752 set thread context of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 set thread context of 4232 1752 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe Token: SeDebugPrivilege 4676 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 1752 Flaseher.exe 4676 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3004 wrote to memory of 3580 3004 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe PID 3580 wrote to memory of 3604 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 3580 wrote to memory of 3604 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 3580 wrote to memory of 3604 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe cmd.exe PID 3604 wrote to memory of 1012 3604 cmd.exe reg.exe PID 3604 wrote to memory of 1012 3604 cmd.exe reg.exe PID 3604 wrote to memory of 1012 3604 cmd.exe reg.exe PID 3580 wrote to memory of 1752 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe PID 3580 wrote to memory of 1752 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe PID 3580 wrote to memory of 1752 3580 5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4676 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe PID 1752 wrote to memory of 4232 1752 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f9067b15272efe16e3d65470ba47980_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JKGEG.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\JKGEG.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
72KB
MD5964b91379e469c32a3168d5f3eefec04
SHA188bd4c4b165b823792d0e72d67cd363187c2fe85
SHA256669f1f9c5bea7491002945cb72e0a78868e3994c60a1c559f2cf2cee897a9465
SHA51200970390e923cd5eb05cfc13b40a4bcb51fb61ce972f7cee7825ac1010450eb5e74a024408c59688dd58f1304673f68b0752137030619d5c60ba87c950a289d1
-
memory/1752-45-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1752-40-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1752-36-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1752-58-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1752-41-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3004-0-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3004-6-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/3004-14-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3004-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/3004-4-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/3004-5-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/3004-3-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/3580-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3580-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3580-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3580-59-0x0000000000410000-0x00000000004D9000-memory.dmpFilesize
804KB
-
memory/3580-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4232-49-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4232-46-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4232-51-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4232-54-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4232-56-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4232-63-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4676-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4676-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB