e5e429693573761352e4532fd4a95ab01d83d0242fb7612623be497f88a47d84

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
Size

326KB
MD5

abd50c1cd984b84e7bb9171a4d668b40
SHA1

8285299d0c83f821624a65406cf43837bb088099
SHA256

e5e429693573761352e4532fd4a95ab01d83d0242fb7612623be497f88a47d84
SHA512

d6c398941acb40317f7e2673a7e41e25f25debf26dea59869ace7aafa6b8987d8481b726caaf77db9d98890114c4becdc4f92b52958b4fbd44cb8e19d2431efc
SSDEEP

6144:Z5CKlxyOYbUUSgigL/dz69B+4w3DzCosAZgbTfipFvWTBFcoy+z:3lxypUUStgL/dKB+4wTZPObTfipNWTH7

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe

Deletes itself 1 IoCs

pid	Process
2648	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	Logo1_.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Logo1_.exe
File created	C:\Program Files\7-Zip\7zFM.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.Exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\WMPDMC.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Java\jre7\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.Exe	Logo1_.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
File created	C:\Windows\Logo1_.exe	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe
2688	Logo1_.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2172	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	28
PID 1424 wrote to memory of 2172	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	28
PID 1424 wrote to memory of 2172	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	28
PID 1424 wrote to memory of 2172	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 2976	2172	net.exe	30
PID 2172 wrote to memory of 2976	2172	net.exe	30
PID 2172 wrote to memory of 2976	2172	net.exe	30
PID 2172 wrote to memory of 2976	2172	net.exe	30
PID 1424 wrote to memory of 2648	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 2648	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 2648	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 2648	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 2688	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	33
PID 1424 wrote to memory of 2688	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	33
PID 1424 wrote to memory of 2688	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	33
PID 1424 wrote to memory of 2688	1424	abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe	33
PID 2688 wrote to memory of 2884	2688	Logo1_.exe	34
PID 2688 wrote to memory of 2884	2688	Logo1_.exe	34
PID 2688 wrote to memory of 2884	2688	Logo1_.exe	34
PID 2688 wrote to memory of 2884	2688	Logo1_.exe	34
PID 2884 wrote to memory of 2768	2884	net.exe	36
PID 2884 wrote to memory of 2768	2884	net.exe	36
PID 2884 wrote to memory of 2768	2884	net.exe	36
PID 2884 wrote to memory of 2768	2884	net.exe	36
PID 2688 wrote to memory of 3012	2688	Logo1_.exe	37
PID 2688 wrote to memory of 3012	2688	Logo1_.exe	37
PID 2688 wrote to memory of 3012	2688	Logo1_.exe	37
PID 2688 wrote to memory of 3012	2688	Logo1_.exe	37
PID 3012 wrote to memory of 2984	3012	net.exe	39
PID 3012 wrote to memory of 2984	3012	net.exe	39
PID 3012 wrote to memory of 2984	3012	net.exe	39
PID 3012 wrote to memory of 2984	3012	net.exe	39
PID 2688 wrote to memory of 1208	2688	Logo1_.exe	21
PID 2688 wrote to memory of 1208	2688	Logo1_.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\$$a1A25.bat
    3⤵
    - Deletes itself
    PID:2648
- - C:\Windows\Logo1_.exe
    C:\Windows\Logo1_.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2768
  - - C:\Windows\SysWOW64\net.exe
      net stop "Kingsoft AntiVirus Service"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        5⤵
        
        PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$a1A25.bat

Filesize
620B

MD5
73a6178f4fc08914f2289ef6bac9ca6e

SHA1
dbe2821bb86c8806f33fe448067c811230f9254d

SHA256
4515156576b73b340e38cc424baa889d97018a86b0368903f21de5f5a132c2a8

SHA512
2de2a65a317448a178b1e87dacf2b4cba62f06f4392738a3d11adf4cbdd213e64550ad8254d4717261069359950809f70dbb9080409b985b6572bedad587b77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\abd50c1cd984b84e7bb9171a4d668b40_NeikiAnalytics.exe.exe

Filesize
268KB

MD5
2b45c64a6386f554b46c34829f410fdb

SHA1
d784b871c1ee4a5429c2c14b5823a19e25c8c1be

SHA256
55f14ed958f1dd04a79a9dafa6da11ff54c0d2bf1e1273e86959a0d375b88bc5

SHA512
d792ed1c2f85f5c413f7da01fe9b92999fb4d0786cb5f1db200cf4cee0c8da78c0b8974893a9993fc7a374c3ba467bd0a494b015530a29dca492b9eace2524a0

Download Submit
C:\Windows\Logo1_.exe

Filesize
57KB

MD5
43695e2b27fd99feb89c7c9c031f2c7f

SHA1
c0d574c9219a3b242627969b1d60e35f57e26084

SHA256
c9b03492eb5dc22bdc6e0a1b5dc9cc9d3a13d3818203dbeb3cc92e39ec51820a

SHA512
55a3a582d96a1e3378f0d0dc4dc8f0a92036e151668958effc4398ec41b2c65c7a43c8479712173718fa41d320acd5b3f56f18d74ec9325be4345867489b28e1

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
832B

MD5
7e3a0edd0c6cd8316f4b6c159d5167a1

SHA1
753428b4736ffb2c9e3eb50f89255b212768c55a

SHA256
1965854dfa54c72529c88c7d9f41fa31b4140cad04cf03d3f0f2e7601fcbdc6c

SHA512
9c68f7f72dfa109fcfba6472a1cced85bc6c2a5481232c6d1d039c88b2f65fb86070aeb26ac23e420c6255daca02ea6e698892f7670298d2c4f741b9e9415c7f

Download Submit
memory/1208-66-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/1424-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1424-1-0x000000000042E000-0x000000000042F000-memory.dmp

Filesize
4KB

Download
memory/1424-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1424-2-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2648-58-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/2688-20-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2688-23-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2688-22-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2688-72-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download