Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 03:18
Behavioral task
behavioral1
Sample
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe
-
Size
326KB
-
MD5
6a23eb83d3d90fc2576b4a6caa891930
-
SHA1
9a9ec32c7c153c5cc348b9a6ff312324623f6a35
-
SHA256
373a196348391d7f1d3b219f2cbe13c021401fe6999287192de858c948ea97d0
-
SHA512
3350d9f8a500e43a364fccd1419f41a8b0e6c4a162fb9ca9271811e6457f25d2d009523184e8cfab63a805ed1bb1a36f0c04acd80ce3d712a2940db47d4a6328
-
SSDEEP
3072:Ie2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:IsxD5cwohO+O1sVG0/pZ6iPC8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/416-53-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/416-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/416-54-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/416-60-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 4392 csrsll.exe 2296 csrsll.exe 416 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/4504-0-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/4504-2-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/664-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/664-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/664-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4504-14-0x0000000000400000-0x0000000000454000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/664-35-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4392-37-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/4392-41-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/416-47-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/416-52-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/416-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4392-55-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/416-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/416-54-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/664-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2296-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/416-60-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.execsrsll.exedescription pid process target process PID 4504 set thread context of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4392 set thread context of 2296 4392 csrsll.exe csrsll.exe PID 4392 set thread context of 416 4392 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 60 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe Token: SeDebugPrivilege 2296 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.execsrsll.execsrsll.exepid process 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 4392 csrsll.exe 2296 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 4504 wrote to memory of 664 4504 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe PID 664 wrote to memory of 3300 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe cmd.exe PID 664 wrote to memory of 3300 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe cmd.exe PID 664 wrote to memory of 3300 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe cmd.exe PID 3300 wrote to memory of 4828 3300 cmd.exe reg.exe PID 3300 wrote to memory of 4828 3300 cmd.exe reg.exe PID 3300 wrote to memory of 4828 3300 cmd.exe reg.exe PID 664 wrote to memory of 4392 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe csrsll.exe PID 664 wrote to memory of 4392 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe csrsll.exe PID 664 wrote to memory of 4392 664 6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 2296 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe PID 4392 wrote to memory of 416 4392 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a23eb83d3d90fc2576b4a6caa891930_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TAGDS.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TAGDS.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
326KB
MD5acd8fcc661d45b89e6683802603d6120
SHA19d75a4a34c46bd7af0a4550545f26407e65a69d8
SHA256db6a48407b7dc9dcb3e99d37b51c106fa3dbc0e53a184359408a331f433ef9f0
SHA51293e296f74384c86eb8d4eb87a1c4fb415be7d206e2afcdbd12bc05fe0550511d678e3b31be49deb26fd05b961c1c266699d4aca255c1b667e5773ea038de9148
-
memory/416-52-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/416-47-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/416-60-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/416-54-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/416-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/416-53-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/664-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/664-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/664-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/664-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/664-35-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2296-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4392-41-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4392-55-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4392-37-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4504-0-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4504-5-0x0000000002310000-0x0000000002312000-memory.dmpFilesize
8KB
-
memory/4504-2-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4504-4-0x00000000022F0000-0x00000000022F2000-memory.dmpFilesize
8KB
-
memory/4504-14-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4504-6-0x0000000002320000-0x0000000002322000-memory.dmpFilesize
8KB