Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 06:49
Behavioral task
behavioral1
Sample
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe
-
Size
90KB
-
MD5
a2d26777029a0632c4f03c17dc50d510
-
SHA1
933a17606c4f9ef4471b5a9a515e966c83dd61dd
-
SHA256
c7630dba78be6069d9f3f34dc8ae89ba50e8e3f987ae79ecdd07ad531d60d904
-
SHA512
21fd9e7dedeeac534e72a55f2d154415d7fe48d5c0ebc5446718f14c787ea0950caab52ab4d969762125a4f0429bb59d5cce8e8b072f5d56cde6169a473d69dc
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3884-48-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3884-53-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3884-51-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3884-50-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3884-59-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 4624 csrsll.exe 4396 csrsll.exe 3884 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/4200-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4484-3-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4484-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4484-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4200-10-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4200-4-0x0000000002A20000-0x0000000002A22000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/4624-35-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3884-40-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3884-48-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3884-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3884-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3884-50-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4624-47-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4484-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3884-46-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4396-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3884-59-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.execsrsll.exedescription pid process target process PID 4200 set thread context of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4624 set thread context of 4396 4624 csrsll.exe csrsll.exe PID 4624 set thread context of 3884 4624 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe Token: SeDebugPrivilege 4396 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exea2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.execsrsll.execsrsll.exepid process 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe 4624 csrsll.exe 4396 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exea2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4200 wrote to memory of 4484 4200 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe PID 4484 wrote to memory of 3184 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe cmd.exe PID 4484 wrote to memory of 3184 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe cmd.exe PID 4484 wrote to memory of 3184 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe cmd.exe PID 3184 wrote to memory of 4900 3184 cmd.exe reg.exe PID 3184 wrote to memory of 4900 3184 cmd.exe reg.exe PID 3184 wrote to memory of 4900 3184 cmd.exe reg.exe PID 4484 wrote to memory of 4624 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe csrsll.exe PID 4484 wrote to memory of 4624 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe csrsll.exe PID 4484 wrote to memory of 4624 4484 a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 4396 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe PID 4624 wrote to memory of 3884 4624 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2d26777029a0632c4f03c17dc50d510_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DYCPF.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:4900 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4396 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:3884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DYCPF.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
90KB
MD55da008d454b4777f5aa02e2ac35e8d2b
SHA18200fcd5194d8466c86b5d3f362764162c39c8fa
SHA2566f086a2c81e75331745734809a41133fdb6a25bcc5b348530e60d7d8d9adfef0
SHA5128f1113aa159860867676052141ca3bd3edc26e760a9fe0c57c3dcfbb062aec008bc8207a0cb249b682793ecb6ce2439c604db794ffc3532e640f3b550e68809f
-
memory/3884-51-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3884-40-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3884-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3884-46-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3884-50-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3884-53-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3884-48-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4200-4-0x0000000002A20000-0x0000000002A22000-memory.dmpFilesize
8KB
-
memory/4200-10-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4200-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4200-6-0x0000000002A40000-0x0000000002A42000-memory.dmpFilesize
8KB
-
memory/4200-7-0x0000000002A50000-0x0000000002A52000-memory.dmpFilesize
8KB
-
memory/4200-5-0x0000000002A30000-0x0000000002A32000-memory.dmpFilesize
8KB
-
memory/4396-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4484-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4484-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4484-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4484-55-0x0000000000410000-0x00000000004D9000-memory.dmpFilesize
804KB
-
memory/4484-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4624-35-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4624-47-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB