Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 03:14
Static task
static1
Behavioral task
behavioral1
Sample
6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe
-
Size
70KB
-
MD5
6231a769c9f0e1708ca758253b80ae50
-
SHA1
fca45c674a1c366cea71a7ae211363a7729f575b
-
SHA256
ac1e856b5338aedc8c8e23b1726ba2c31e7971b3aa1931ae55c95c9c1c1a1a05
-
SHA512
a6582d62234cb562c120b14ee1fc939d04016d2c3aecd730d07d093edb38b5f30d0acd700a64a063bf8fad79af3b8fc3907206ca66080748e2692dfd08b70089
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8FgO:Olg35GTslA5t3/w85
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" eassikoab-exoas.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\StubPath = "C:\\Windows\\system32\\emxuvood.exe" eassikoab-exoas.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55} eassikoab-exoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\IsInstalled = "1" eassikoab-exoas.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe eassikoab-exoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" eassikoab-exoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oxsetof-bom.exe" eassikoab-exoas.exe -
Executes dropped EXE 2 IoCs
pid Process 2392 eassikoab-exoas.exe 3116 eassikoab-exoas.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" eassikoab-exoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" eassikoab-exoas.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify eassikoab-exoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" eassikoab-exoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ofbootoof-oufooc.dll" eassikoab-exoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" eassikoab-exoas.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} eassikoab-exoas.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\emxuvood.exe eassikoab-exoas.exe File opened for modification C:\Windows\SysWOW64\ofbootoof-oufooc.dll eassikoab-exoas.exe File opened for modification C:\Windows\SysWOW64\eassikoab-exoas.exe 6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\emxuvood.exe eassikoab-exoas.exe File created C:\Windows\SysWOW64\oxsetof-bom.exe eassikoab-exoas.exe File created C:\Windows\SysWOW64\ofbootoof-oufooc.dll eassikoab-exoas.exe File opened for modification C:\Windows\SysWOW64\eassikoab-exoas.exe eassikoab-exoas.exe File created C:\Windows\SysWOW64\eassikoab-exoas.exe 6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\oxsetof-bom.exe eassikoab-exoas.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 3116 eassikoab-exoas.exe 3116 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe 2392 eassikoab-exoas.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1980 6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe Token: SeDebugPrivilege 2392 eassikoab-exoas.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2392 1980 6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe 83 PID 1980 wrote to memory of 2392 1980 6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe 83 PID 1980 wrote to memory of 2392 1980 6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe 83 PID 2392 wrote to memory of 600 2392 eassikoab-exoas.exe 5 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3116 2392 eassikoab-exoas.exe 84 PID 2392 wrote to memory of 3116 2392 eassikoab-exoas.exe 84 PID 2392 wrote to memory of 3116 2392 eassikoab-exoas.exe 84 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56 PID 2392 wrote to memory of 3556 2392 eassikoab-exoas.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:600
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6231a769c9f0e1708ca758253b80ae50_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\eassikoab-exoas.exe"C:\Windows\system32\eassikoab-exoas.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\eassikoab-exoas.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD56231a769c9f0e1708ca758253b80ae50
SHA1fca45c674a1c366cea71a7ae211363a7729f575b
SHA256ac1e856b5338aedc8c8e23b1726ba2c31e7971b3aa1931ae55c95c9c1c1a1a05
SHA512a6582d62234cb562c120b14ee1fc939d04016d2c3aecd730d07d093edb38b5f30d0acd700a64a063bf8fad79af3b8fc3907206ca66080748e2692dfd08b70089
-
Filesize
72KB
MD5949930756f6b30ff14f8610ca5a4823c
SHA19965f6d62918d3d222f3808294c2429b29efddf1
SHA25637a2f99291e2ef7b20e537b1608782949a4b38de1d0e787d1f322c8da85fa35d
SHA51296e48bd5ae562952637b13ada86bb82b21dc4dafcaf4166f1c7cb2d01c2beb5791d2be2b6b90896ec4031f71a13090493f732ff8ecd2627dc548b3be60f20c96
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD57e55365fdd56cc18a8dd7daeec2afaa8
SHA109c90ad376eb2bc32302eb6540bf0d83528bf147
SHA2566cd6c52173e7dc9785055f6f984716fdc5a0a12adc09caf67fced644641b6bd8
SHA5126301a9be2607157cd99eaf93e96d3ef15cee693d6703c9834e51695fb7258a5e80844d9a6b431d45e22aa6e628e5b601b1291ee79f8940946f04abee3c0f6b38