Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
13/05/2024, 07:37
General
- Target a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
- Size 91KB
- Sample240513-jf2fdscf5x
- SHA256 7c68e6466b11eaf49109e1dfa6981ccba66f1d1989f390bea75a3362018e0b63
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
- Disables RegEdit via registry modification 2 IoCs
- Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
- Modifies system executable filetype association 2 TTPs 13 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Drops file in System32 directory 6 IoCs
- Drops file in Windows directory 2 IoCs
- Modifies Control Panel 4 IoCs
- Modifies registry class 15 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- System policy modification 1 TTPs 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
CSRSS.EXE
winlogon.exe
LSASS.EXE
SERVICES.EXE
SMSS.EXE
WINLOGON.EXE
IExplorer.exe
xk.exe
memory/800-117-0x0000000000400000-0x000000000042C000-memory.dmp
memory/800-112-0x0000000000400000-0x000000000042C000-memory.dmp
memory/800-120-0x0000000000400000-0x000000000042C000-memory.dmp
memory/800-113-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/1352-144-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/1352-151-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1352-148-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1624-155-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/1624-160-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1688-182-0x0000000000401000-0x0000000000427000-memory.dmp
memory/1688-1-0x00000000001C0000-0x00000000001C4000-memory.dmp
memory/1688-181-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1688-0-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1688-5-0x0000000000401000-0x0000000000427000-memory.dmp
memory/1688-2-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/1688-154-0x00000000001C0000-0x00000000001C4000-memory.dmp
memory/1688-158-0x0000000000401000-0x0000000000427000-memory.dmp
memory/1688-3-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2356-179-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2356-174-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/4580-125-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/4580-123-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4580-131-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4580-128-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4580-124-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4840-164-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4840-165-0x0000000075A00000-0x0000000075B5D000-memory.dmp
memory/4840-170-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4916-139-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4916-135-0x0000000075A00000-0x0000000075B5D000-memory.dmp