Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe
-
Size
70KB
-
MD5
a398310cac612dd27926ccff2f206ae0
-
SHA1
ff5fe2c0a4f3aec7a6b88a5c64c897c3ec71a968
-
SHA256
b5b8e887666d37b382d4ea9fa5516881ae2208ad26d70e60b3ea3c297850a9d3
-
SHA512
fb35dda335b0d6f6617014f79978b5cff8a9830d0dfbebe354ccb6a6c2b8d3c474af09da7fbfa24043a6230240580e40d6874defe39b77567517f7c591973fdd
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slp:Olg35GTslA5t3/w8w
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ixxofax.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350} ixxofax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\IsInstalled = "1" ixxofax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\StubPath = "C:\\Windows\\system32\\eatximoom-udeab.exe" ixxofax.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ixxofax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ixxofax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ekroocar-sat.exe" ixxofax.exe -
Executes dropped EXE 2 IoCs
pid Process 2120 ixxofax.exe 2620 ixxofax.exe -
Loads dropped DLL 3 IoCs
pid Process 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe 2120 ixxofax.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ixxofax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ixxofax.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ixxofax.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ixxofax.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ixxofax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ixxofax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\igcooseak.dll" ixxofax.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ekroocar-sat.exe ixxofax.exe File opened for modification C:\Windows\SysWOW64\igcooseak.dll ixxofax.exe File opened for modification C:\Windows\SysWOW64\ixxofax.exe a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ixxofax.exe a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ekroocar-sat.exe ixxofax.exe File opened for modification C:\Windows\SysWOW64\ixxofax.exe ixxofax.exe File opened for modification C:\Windows\SysWOW64\eatximoom-udeab.exe ixxofax.exe File created C:\Windows\SysWOW64\eatximoom-udeab.exe ixxofax.exe File created C:\Windows\SysWOW64\igcooseak.dll ixxofax.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2620 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe 2120 ixxofax.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe Token: SeDebugPrivilege 2120 ixxofax.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2120 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe 28 PID 1736 wrote to memory of 2120 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe 28 PID 1736 wrote to memory of 2120 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe 28 PID 1736 wrote to memory of 2120 1736 a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe 28 PID 2120 wrote to memory of 428 2120 ixxofax.exe 5 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 2620 2120 ixxofax.exe 29 PID 2120 wrote to memory of 2620 2120 ixxofax.exe 29 PID 2120 wrote to memory of 2620 2120 ixxofax.exe 29 PID 2120 wrote to memory of 2620 2120 ixxofax.exe 29 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21 PID 2120 wrote to memory of 1208 2120 ixxofax.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a398310cac612dd27926ccff2f206ae0_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\ixxofax.exe"C:\Windows\system32\ixxofax.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\ixxofax.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5f4d695353e3d9a4fc4d447a19aa6fcda
SHA19bd064d583c4535ab25f10cb057cf203ddff31b9
SHA256bc3150a92f999ea0ecce1ca6adf239247e17583a701a81399cc02ba5fcdcb3cf
SHA5121de008d7fe1d67924fbda752b8a492c21c7e9a8403aa0e240f3de22acf8b4431b4277992f7449b38e7598bb73248530608ca5cdee6796a4a78d4fb30f41d61f2
-
Filesize
74KB
MD54c5c042051a0d391887fabdba6c80493
SHA18b7ff807d422870ab8db20c68073478f1fc4063a
SHA256158c50f6e0033be4b18780e204609c06e1aa20e176bfabfda75f19becabb5228
SHA512f5b0b9233b154ecdb7d49c55efc6b0422850f409e090c2650619fa37862dc05ea14152bf28dc9d51b67200cd337841e81c25749bc460c02cb56432505f236cd3
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
70KB
MD5a398310cac612dd27926ccff2f206ae0
SHA1ff5fe2c0a4f3aec7a6b88a5c64c897c3ec71a968
SHA256b5b8e887666d37b382d4ea9fa5516881ae2208ad26d70e60b3ea3c297850a9d3
SHA512fb35dda335b0d6f6617014f79978b5cff8a9830d0dfbebe354ccb6a6c2b8d3c474af09da7fbfa24043a6230240580e40d6874defe39b77567517f7c591973fdd