Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 03:16
Behavioral task
behavioral1
Sample
6259428e226dabc3588958b427d10100_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6259428e226dabc3588958b427d10100_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6259428e226dabc3588958b427d10100_NeikiAnalytics.exe
-
Size
130KB
-
MD5
6259428e226dabc3588958b427d10100
-
SHA1
93a5472b819cb59d99c9f7895dca7a787275f05d
-
SHA256
f20d05e66f24d54610761277ef3bbbc20b6b6aab1f66204c83435f836129a2bb
-
SHA512
f820df6051c9d07da9d737fb54e7dede7524f3935c155f3a032c3ca64a8e060ffa295860cf9491ebba8c10da60e1045c555f4dd9c72d2d9f2dd59814e7afb03e
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmX:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3868-45-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3868-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3868-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3868-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3868-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3868-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6259428e226dabc3588958b427d10100_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 3828 Flaseher.exe 3560 Flaseher.exe 3868 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/4708-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4048-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4048-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4708-12-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4048-11-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/3828-36-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3828-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3828-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3828-48-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4048-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3560-57-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6259428e226dabc3588958b427d10100_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 4708 set thread context of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 3828 set thread context of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 set thread context of 3868 3828 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe Token: SeDebugPrivilege 3560 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6259428e226dabc3588958b427d10100_NeikiAnalytics.exe6259428e226dabc3588958b427d10100_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 3828 Flaseher.exe 3560 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
6259428e226dabc3588958b427d10100_NeikiAnalytics.exe6259428e226dabc3588958b427d10100_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4708 wrote to memory of 4048 4708 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe PID 4048 wrote to memory of 3096 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe cmd.exe PID 4048 wrote to memory of 3096 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe cmd.exe PID 4048 wrote to memory of 3096 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe cmd.exe PID 3096 wrote to memory of 1320 3096 cmd.exe reg.exe PID 3096 wrote to memory of 1320 3096 cmd.exe reg.exe PID 3096 wrote to memory of 1320 3096 cmd.exe reg.exe PID 4048 wrote to memory of 3828 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe Flaseher.exe PID 4048 wrote to memory of 3828 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe Flaseher.exe PID 4048 wrote to memory of 3828 4048 6259428e226dabc3588958b427d10100_NeikiAnalytics.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3560 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe PID 3828 wrote to memory of 3868 3828 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6259428e226dabc3588958b427d10100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6259428e226dabc3588958b427d10100_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\6259428e226dabc3588958b427d10100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6259428e226dabc3588958b427d10100_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\APXOC.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:1320 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3560 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\APXOC.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD5ec788c71d758721efb1cd18ed4e546d6
SHA124b64a5ab272588430549add5cba701a472a90dc
SHA2562d60777553dc26f8758fbe078dafc3f264ea5a3c07c085b52c00668c1bed4e70
SHA5129d62e9a8b222dd4bc9a66028344048f9014585837744e676cb90090de6676554baee105f62e94f56e043339899f553a1e593a1e456098404437d93f41e7918f6
-
memory/3560-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3828-48-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3828-40-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3828-39-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3828-36-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3868-51-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3868-54-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3868-58-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3868-53-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3868-49-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3868-45-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4048-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4048-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4048-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4048-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4708-6-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/4708-3-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/4708-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4708-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4708-4-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/4708-12-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4708-5-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB