a5120c58ecd01a9d12b13628e55185dc44fac200a4da498d21d70df4f6e13e4a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe
Size

73KB
MD5

36f1e5ef8393e1af7d0f326c89707c40
SHA1

06e996748f5c68ca59bea188600c2e2edf3ce0d5
SHA256

a5120c58ecd01a9d12b13628e55185dc44fac200a4da498d21d70df4f6e13e4a
SHA512

37ddc5d925d10715766f10be3c8b0de7b10d971fc8b5d9227ec24cb98a70a24bc9bded955ee4dae322e345091f0b58fbfc8482a615bbba16ae940eb81ef06ae8
SSDEEP

1536:xCbu2+qEzyX/vh4K+AI5JZC17KNfeCIG3nc3ij/OVVhcEnYN6VV:gu2+qEzyX/vh4K+AI5JZCMN1I2nSiDON

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ourcuver.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\IsInstalled = "1"	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\StubPath = "C:\\Windows\\system32\\ubmoacood-ecom.exe"	ourcuver.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\abmitec-ocom.exe"	ourcuver.exe

Executes dropped EXE 2 IoCs

pid	Process
1296	ourcuver.exe
216	ourcuver.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ourcuver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ourcuver.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ourcuver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\xcoonix.dll"	ourcuver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ourcuver.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ourcuver.exe	36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\ubmoacood-ecom.exe	ourcuver.exe
File opened for modification	C:\Windows\SysWOW64\xcoonix.dll	ourcuver.exe
File created	C:\Windows\SysWOW64\xcoonix.dll	ourcuver.exe
File opened for modification	C:\Windows\SysWOW64\ourcuver.exe	ourcuver.exe
File created	C:\Windows\SysWOW64\ourcuver.exe	36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\abmitec-ocom.exe	ourcuver.exe
File created	C:\Windows\SysWOW64\abmitec-ocom.exe	ourcuver.exe
File opened for modification	C:\Windows\SysWOW64\ubmoacood-ecom.exe	ourcuver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
216	ourcuver.exe
216	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe
1296	ourcuver.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	ourcuver.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 1296	3584	36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe	82
PID 3584 wrote to memory of 1296	3584	36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe	82
PID 3584 wrote to memory of 1296	3584	36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe	82
PID 1296 wrote to memory of 216	1296	ourcuver.exe	83
PID 1296 wrote to memory of 216	1296	ourcuver.exe	83
PID 1296 wrote to memory of 216	1296	ourcuver.exe	83
PID 1296 wrote to memory of 612	1296	ourcuver.exe	5
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56
PID 1296 wrote to memory of 3424	1296	ourcuver.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\36f1e5ef8393e1af7d0f326c89707c40_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\ourcuver.exe
    "C:\Windows\SysWOW64\ourcuver.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\ourcuver.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\abmitec-ocom.exe

Filesize
74KB

MD5
f6b47134ad2fd7ff6c1af7ba9b395ec8

SHA1
709de13d92f139685f3e98b0265293076125acbe

SHA256
083f361fc3a7ed4f241774f7b2683af9639712ee1ed5bf3cae55a2dda89b0567

SHA512
43602137a3a485fa5d45adb47050a20837e6b88820d5c856d6ccc081310ba8e0a4d4f13bac63f4efc558d91310002c54989e6f42067646df59afcb7bc6b5468e

Download Submit
C:\Windows\SysWOW64\ourcuver.exe

Filesize
71KB

MD5
4dc47f940f49070af3a9d0a7af195d9d

SHA1
76941c88fb688d4854e47ad6fb3495e5d594e600

SHA256
f6d2b38109c69b3ea3d3deb2d8c7b6a38f81946b719a56e07bb0ceed0dae04d7

SHA512
d6e5251e759d5925a33ae2396329bcf3fa09d99e4399dcf69f4f2ccf98762727c229f6a026a2252f9543c5ef57df797f4a5398a49922b0cd6d42672d0931c0cb

Download Submit
C:\Windows\SysWOW64\ubmoacood-ecom.exe

Filesize
73KB

MD5
bb794cc7905557664fe241319a57541f

SHA1
ab05088e23be5bf69aa2fb12b3447ff82fc698c2

SHA256
0d99f0c101714f42b885800ee886bb10e7655355b78b472cb35575a821f337d4

SHA512
a7f14843b2115ab9be7b431d15418a3ff4e68527702065a73cd8cb6a3b66fd2dcef72cc504ba39e41971e7cf63cbb9fcc7502ab47415331d11577706720dd652

Download Submit
C:\Windows\SysWOW64\xcoonix.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
memory/216-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1296-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3584-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download