7606c6d04811e886949fe5292193b28a1b2e92bf3f02bbb7daa207f40afece88

General

Target

7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Size

15KB
MD5

7773f5540b8a9de6a0177a0b93f5ee10
SHA1

03d70b11f6cc84325837d5465eee3240bd1bf227
SHA256

7606c6d04811e886949fe5292193b28a1b2e92bf3f02bbb7daa207f40afece88
SHA512

2dd752cdf3c89734ec4a3f6bcd517c915dc07dd49bf23f55b126ce0bc800818aa715cd8333b56d25dce7c15a1740ba6cd901f868ef766a19bac205f6f2456bd6
SSDEEP

384:D6beVjFjyrtvuo1071bkw7KTCfceK/bWFuDic4O:D6bOjypv0hk2UCUVCFu2VO

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	svchost.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a00000002345c-4.dat	acprotect

Deletes itself 1 IoCs

pid	Process
1208	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1208	svchost.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a00000002345c-4.dat	upx
behavioral2/memory/1208-5-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/1208-6-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/1208-8-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral2/memory/1208-14-0x0000000010000000-0x000000001000E000-memory.dmp	upx

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\ver = "3"	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\DLLName = "sysfldr.dll"	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\Startup = "Startup"	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\Srv = "ZHh4fDYjIzQ9IjU5Ij05PCI1NCN/b354I2ViInxkfAEG"	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sysfldr\SrvUp = "ZHh4fDYjIzQ9IjU5Ij05PCI1NCN/b354I2ViInxkfAEG"	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysfldr.dll	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 1208	3004	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe	86

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1208	3004	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe	86
PID 3004 wrote to memory of 1208	3004	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe	86
PID 3004 wrote to memory of 1208	3004	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe	86
PID 3004 wrote to memory of 1208	3004	7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7773f5540b8a9de6a0177a0b93f5ee10_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Modifies security service
  - Deletes itself
  - Loads dropped DLL
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sysfldr.dll

Filesize
12KB

MD5
0dbc821851c9330eb9aadc94f6dc2b61

SHA1
c35084067259a4f6c19c579be61f05b3eb914371

SHA256
90fd732c310f490a676d5573b463c386399cff25c9bf959f10c05038c7795e22

SHA512
bad8f665315b310ba02a8eb9363b44061ee520c809550ae56f7b3c9c3a2ec44b6c338200f5c56e4c6d0f995c38e292535646a30ec4ceed366e96acd88410ca53

Download Submit
memory/1208-5-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1208-3-0x0000000013140000-0x0000000013146000-memory.dmp

Filesize
24KB

Download
memory/1208-6-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1208-8-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1208-14-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/3004-0-0x0000000013140000-0x0000000013146000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads