2a8b040291985b8aa4fad28355af430ef0cf5bbbd2e6195fb7504160b62b881e

General

Target

89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
Size

1.0MB
MD5

89bbf8129dfc8b3d9b760c2d3fcd6e70
SHA1

73192e8dc4a0d6cdfc9563483da4d1cc0bed67de
SHA256

2a8b040291985b8aa4fad28355af430ef0cf5bbbd2e6195fb7504160b62b881e
SHA512

c6ebb83aef2807aa46a546ae58ce74c53716678f44473d9183a6b364b73a0312c500abf8f4247ba34bc3e1fcb31185197828ff3a8cd1ffa1fddbe05f40605b52
SSDEEP

12288:yhqxHfPKSyKt09bVUHJNpX1sB67l+YPciyT9SOH5/V6NS8N0gMg++TOFL7ClN2jQ:yhG+I9s6x+Yxgr5/VmMgo97Fku8

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\amine.exe,"	reg.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3068	amine.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1392	PING.EXE
2264	PING.EXE
2084	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
3068	amine.exe
3068	amine.exe
3068	amine.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
Token: SeDebugPrivilege	3068	amine.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 1996	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe	95
PID 448 wrote to memory of 1996	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe	95
PID 448 wrote to memory of 1996	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe	95
PID 1996 wrote to memory of 1392	1996	cmd.exe	97
PID 1996 wrote to memory of 1392	1996	cmd.exe	97
PID 1996 wrote to memory of 1392	1996	cmd.exe	97
PID 448 wrote to memory of 3828	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe	103
PID 448 wrote to memory of 3828	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe	103
PID 448 wrote to memory of 3828	448	89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe	103
PID 3828 wrote to memory of 2264	3828	cmd.exe	105
PID 3828 wrote to memory of 2264	3828	cmd.exe	105
PID 3828 wrote to memory of 2264	3828	cmd.exe	105
PID 1996 wrote to memory of 2376	1996	cmd.exe	106
PID 1996 wrote to memory of 2376	1996	cmd.exe	106
PID 1996 wrote to memory of 2376	1996	cmd.exe	106
PID 3828 wrote to memory of 2084	3828	cmd.exe	107
PID 3828 wrote to memory of 2084	3828	cmd.exe	107
PID 3828 wrote to memory of 2084	3828	cmd.exe	107
PID 3828 wrote to memory of 3068	3828	cmd.exe	109
PID 3828 wrote to memory of 3068	3828	cmd.exe	109
PID 3828 wrote to memory of 3068	3828	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe,"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 36
    3⤵
    - Runs ping.exe
    PID:1392
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe,"
    3⤵
    - Modifies WinLogon for persistence
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 49 > nul && copy "C:\Users\Admin\AppData\Local\Temp\89bbf8129dfc8b3d9b760c2d3fcd6e70_NeikiAnalytics.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe" && ping 127.0.0.1 -n 49 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 49
    3⤵
    - Runs ping.exe
    PID:2264
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 49
    3⤵
    - Runs ping.exe
    PID:2084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amine.exe

Filesize
1.0MB

MD5
89bbf8129dfc8b3d9b760c2d3fcd6e70

SHA1
73192e8dc4a0d6cdfc9563483da4d1cc0bed67de

SHA256
2a8b040291985b8aa4fad28355af430ef0cf5bbbd2e6195fb7504160b62b881e

SHA512
c6ebb83aef2807aa46a546ae58ce74c53716678f44473d9183a6b364b73a0312c500abf8f4247ba34bc3e1fcb31185197828ff3a8cd1ffa1fddbe05f40605b52

Download Submit
memory/448-4-0x0000000005470000-0x000000000550C000-memory.dmp

Filesize
624KB

Download
memory/448-12-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/448-3-0x00000000053D0000-0x0000000005462000-memory.dmp

Filesize
584KB

Download
memory/448-0-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/448-5-0x0000000005590000-0x00000000055D4000-memory.dmp

Filesize
272KB

Download
memory/448-6-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/448-2-0x00000000058E0000-0x0000000005E84000-memory.dmp

Filesize
5.6MB

Download
memory/448-9-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/448-7-0x0000000005840000-0x000000000584A000-memory.dmp

Filesize
40KB

Download
memory/448-10-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/448-8-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/448-1-0x0000000000B00000-0x0000000000C02000-memory.dmp

Filesize
1.0MB

Download
memory/3068-18-0x0000000000D90000-0x0000000000E92000-memory.dmp

Filesize
1.0MB

Download
memory/3068-19-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/3068-20-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads