bf6cc829ea87f7f6ab6d89f575cefb8edf4a43dafa43f79d9680b6f446d38e4e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
Size

1.1MB
MD5

9a1d494a00012d72607e80975c18d260
SHA1

74bd2e7d5f846770ab8e6d077c67965b25f7df2f
SHA256

bf6cc829ea87f7f6ab6d89f575cefb8edf4a43dafa43f79d9680b6f446d38e4e
SHA512

719b5ad877d16a42901b831b8d0be673c97ff343c7a42bee1ee7552b889ca0cfc4b23ce2cee4f11283a75bbe1e10c994ccd637412534f21efa9a51251810eda9
SSDEEP

6144:BDCwjtev1dQ7sdtTS9lE2cmttDCwjtev1dQ7sdtTS9lE2cmtqDCwjtev1dQ7sdtT:B3sRC9f3sRC9Q3sRC9f3sRC90

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\NQPTTMRM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\NQPTTMRM = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\NQPTTMRM = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
844	avscan.exe
2896	avscan.exe
4556	hosts.exe
5052	hosts.exe
4952	avscan.exe
2716	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	\??\c:\windows\W_X_C.bat	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4072	REG.exe
3444	REG.exe
4452	REG.exe
536	REG.exe
1752	REG.exe
384	REG.exe
3036	REG.exe
3328	REG.exe
2796	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
844	avscan.exe
4556	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
844	avscan.exe
2896	avscan.exe
4556	hosts.exe
5052	hosts.exe
4952	avscan.exe
2716	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 384	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	84
PID 3844 wrote to memory of 384	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	84
PID 3844 wrote to memory of 384	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	84
PID 3844 wrote to memory of 844	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	86
PID 3844 wrote to memory of 844	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	86
PID 3844 wrote to memory of 844	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	86
PID 844 wrote to memory of 2896	844	avscan.exe	87
PID 844 wrote to memory of 2896	844	avscan.exe	87
PID 844 wrote to memory of 2896	844	avscan.exe	87
PID 844 wrote to memory of 1880	844	avscan.exe	88
PID 844 wrote to memory of 1880	844	avscan.exe	88
PID 844 wrote to memory of 1880	844	avscan.exe	88
PID 3844 wrote to memory of 1984	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	89
PID 3844 wrote to memory of 1984	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	89
PID 3844 wrote to memory of 1984	3844	9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe	89
PID 1984 wrote to memory of 4556	1984	cmd.exe	92
PID 1984 wrote to memory of 4556	1984	cmd.exe	92
PID 1984 wrote to memory of 4556	1984	cmd.exe	92
PID 1880 wrote to memory of 5052	1880	cmd.exe	93
PID 1880 wrote to memory of 5052	1880	cmd.exe	93
PID 1880 wrote to memory of 5052	1880	cmd.exe	93
PID 4556 wrote to memory of 4952	4556	hosts.exe	95
PID 4556 wrote to memory of 4952	4556	hosts.exe	95
PID 4556 wrote to memory of 4952	4556	hosts.exe	95
PID 4556 wrote to memory of 3728	4556	hosts.exe	96
PID 4556 wrote to memory of 3728	4556	hosts.exe	96
PID 4556 wrote to memory of 3728	4556	hosts.exe	96
PID 1984 wrote to memory of 2228	1984	cmd.exe	97
PID 1984 wrote to memory of 2228	1984	cmd.exe	97
PID 1984 wrote to memory of 2228	1984	cmd.exe	97
PID 1880 wrote to memory of 4204	1880	cmd.exe	99
PID 1880 wrote to memory of 4204	1880	cmd.exe	99
PID 1880 wrote to memory of 4204	1880	cmd.exe	99
PID 3728 wrote to memory of 2716	3728	cmd.exe	100
PID 3728 wrote to memory of 2716	3728	cmd.exe	100
PID 3728 wrote to memory of 2716	3728	cmd.exe	100
PID 3728 wrote to memory of 4372	3728	cmd.exe	101
PID 3728 wrote to memory of 4372	3728	cmd.exe	101
PID 3728 wrote to memory of 4372	3728	cmd.exe	101
PID 844 wrote to memory of 4072	844	avscan.exe	121
PID 844 wrote to memory of 4072	844	avscan.exe	121
PID 844 wrote to memory of 4072	844	avscan.exe	121
PID 4556 wrote to memory of 3036	4556	hosts.exe	124
PID 4556 wrote to memory of 3036	4556	hosts.exe	124
PID 4556 wrote to memory of 3036	4556	hosts.exe	124
PID 844 wrote to memory of 3444	844	avscan.exe	127
PID 844 wrote to memory of 3444	844	avscan.exe	127
PID 844 wrote to memory of 3444	844	avscan.exe	127
PID 4556 wrote to memory of 3328	4556	hosts.exe	129
PID 4556 wrote to memory of 3328	4556	hosts.exe	129
PID 4556 wrote to memory of 3328	4556	hosts.exe	129
PID 844 wrote to memory of 4452	844	avscan.exe	132
PID 844 wrote to memory of 4452	844	avscan.exe	132
PID 844 wrote to memory of 4452	844	avscan.exe	132
PID 4556 wrote to memory of 536	4556	hosts.exe	134
PID 4556 wrote to memory of 536	4556	hosts.exe	134
PID 4556 wrote to memory of 536	4556	hosts.exe	134
PID 844 wrote to memory of 2796	844	avscan.exe	144
PID 844 wrote to memory of 2796	844	avscan.exe	144
PID 844 wrote to memory of 2796	844	avscan.exe	144
PID 4556 wrote to memory of 1752	4556	hosts.exe	146
PID 4556 wrote to memory of 1752	4556	hosts.exe	146
PID 4556 wrote to memory of 1752	4556	hosts.exe	146

C:\Users\Admin\AppData\Local\Temp\9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a1d494a00012d72607e80975c18d260_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:384
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5052
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:4204
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4072
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3444
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4452
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:4372
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3036
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3328
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:536
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1752
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avscan.exe

Filesize
1.1MB

MD5
a1ec6eb43f5354f6fd8df59a002b1f4b

SHA1
dbca41365f4b08ccb8ec551abfffc11b0ac54897

SHA256
a941abb65ba7ff3d250af0e82ad3ea84dc09e122cdc1b9d07171feba8d3e941a

SHA512
23ae31a40126729a225f6629b6e26539875b9a970ddc7527277f85f17c4e85133496edd83290dea78a9af290f256ecb0b21e7e6b3e8141e056e74f336fcbb99b

Download Submit
C:\Windows\W_X_C.vbs

Filesize
195B

MD5
f27cef9495f536c11d356777b305847d

SHA1
9d6fb9a10f1159ed73ab8a0aa8a3f0438147c485

SHA256
29911794a8c4da0895bee606c9a9e53eeaadf25bf8bb0a4a9bc914b84e2d3d48

SHA512
6eaa251a1955539893db99f66812d32687575393a5b1235f17d5153511281ac0f0778142f928f9fc9f3a46a5d80ee38349147ee96977bc19bbaa258121ef9e97

Download Submit
C:\Windows\hosts.exe

Filesize
1.1MB

MD5
4272a974aaa3c1519d3a56b5e8d7286a

SHA1
dd8b27c0eeacb1fea6efe879058d5b0afc04610b

SHA256
f341bf88eb19d09ec025e689b70e6504619df013d86afd64c26c6e2cdcb19921

SHA512
ce7f687b025b7dcdbbab55dc4a3a33d62cfa3739833749a38205da4571d58b726d43f67620034b4cbb16586e46dbe7c7d9ab757645f5128b9a713bfb36396b93

Download Submit
\??\c:\windows\W_X_C.bat

Filesize
336B

MD5
4db9f8b6175722b62ececeeeba1ce307

SHA1
3b3ba8414706e72a6fa19e884a97b87609e11e47

SHA256
d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78

SHA512
1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b

Download Submit
memory/2716-44-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2716-45-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2896-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2896-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3844-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4952-40-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5052-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads