Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
a2c4b15f342bba68ff3953554261f2d0
-
SHA1
d1ee6a1afc47e521b05ce54c3df4684b527c1673
-
SHA256
3aa34f47d9eac7781ddcb8296dc9c8df8adbf8a76d92a81fad4ee67e03ceb67f
-
SHA512
8243158aea89503a7a0cf9c1f8a1031757ad84ccddf19eb1e69b376ef49249d48103185a482edf9635adff394161fe8eb6d4942d53e640dd4e040acefe196d5d
-
SSDEEP
1536:vNyg8r8QZReCd7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:8ReCdJJjmLM3zRJWZsXy4Jt
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zbrox.exe -
Executes dropped EXE 1 IoCs
pid Process 2080 zbrox.exe -
Loads dropped DLL 2 IoCs
pid Process 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbrox = "C:\\Users\\Admin\\zbrox.exe" zbrox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe 2080 zbrox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe 2080 zbrox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2080 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2080 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2080 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2080 1924 a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27 PID 2080 wrote to memory of 1924 2080 zbrox.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2c4b15f342bba68ff3953554261f2d0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\zbrox.exe"C:\Users\Admin\zbrox.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD50584f30c2fa4ef09caaf6de3545e2c2c
SHA166e94fb2aec9d3f88eacecf63b84b86e5e99d3f3
SHA25686d3a0f880c30ea474a83cbbf7e69f5a50ca37e4c7fe74198ced7f2abb331de8
SHA512cb294f15bd2f84aedfe418b2b3021ff010123de1f5d9a8c2277bb85eae9f31beffedb6c30118d68613ada4f1bae74d6fbcc39d16a056bb85549bd3722255f4ec