94e54aa6e82d9bfa8396a7d7465b27677bf785bd0408e16cd3237ea016ecb4c7

Analysis

max time kernel
149s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
Size 70KB
Sample240513-lqds7agh2x
SHA256 94e54aa6e82d9bfa8396a7d7465b27677bf785bd0408e16cd3237ea016ecb4c7
MD5 af8283a2b654ab00d5d20002794cbd00
SHA1 22b96401a9879e838509c36255aa4bdc6ef3f6ae
SHA512 371e8fe1e627d13f3117d3c77d264235d6ceee4e01c1d7fc029951736ab6a6069a9db8a6a279d213e30f4bf754491279f06c71695768fc0d821fd374ff091edc
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl6i:Olg35GTslA5t3/w87i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oudbavoaf.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\IsInstalled = "1"	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\StubPath = "C:\\Windows\\system32\\iffehom-ofoot.exe"	oudbavoaf.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\agxotun-coot.exe"	oudbavoaf.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	oudbavoaf.exe
1172	oudbavoaf.exe

Loads dropped DLL 3 IoCs

pid	Process
2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
2852	oudbavoaf.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oudbavoaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oudbavoaf.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	oudbavoaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\odcoakug.dll"	oudbavoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	oudbavoaf.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oudbavoaf.exe	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\agxotun-coot.exe	oudbavoaf.exe
File created	C:\Windows\SysWOW64\agxotun-coot.exe	oudbavoaf.exe
File opened for modification	C:\Windows\SysWOW64\iffehom-ofoot.exe	oudbavoaf.exe
File created	C:\Windows\SysWOW64\iffehom-ofoot.exe	oudbavoaf.exe
File created	C:\Windows\SysWOW64\odcoakug.dll	oudbavoaf.exe
File opened for modification	C:\Windows\SysWOW64\oudbavoaf.exe	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\oudbavoaf.exe	oudbavoaf.exe
File opened for modification	C:\Windows\SysWOW64\odcoakug.dll	oudbavoaf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
1172	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe
2852	oudbavoaf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
Token: SeDebugPrivilege	2852	oudbavoaf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2852	2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 2852	2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 2852	2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe	28
PID 2988 wrote to memory of 2852	2988	af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 432	2852	oudbavoaf.exe	5
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1172	2852	oudbavoaf.exe	29
PID 2852 wrote to memory of 1172	2852	oudbavoaf.exe	29
PID 2852 wrote to memory of 1172	2852	oudbavoaf.exe	29
PID 2852 wrote to memory of 1172	2852	oudbavoaf.exe	29
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21
PID 2852 wrote to memory of 1220	2852	oudbavoaf.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220
- C:\Users\Admin\AppData\Local\Temp\af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\af8283a2b654ab00d5d20002794cbd00_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\oudbavoaf.exe
    "C:\Windows\system32\oudbavoaf.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\oudbavoaf.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agxotun-coot.exe

Path C:\Windows\SysWOW64\agxotun-coot.exe
Size 74KB
SHA256 c5a2087a169c46f5cf7c77c7eb8d9bca451cddb677a93c5fae6a9e36f32ecc7d
MD5 41ac9db4141194bfe2bf346c5bc1d600
SHA1 edb8854a81c404ff02423e0f45e3ee524927f6b7
SHA512 93d87995c460390887fe9021c9c3d6515062fdb133c006392d33e8d7d343d44cfd7b609ebc6c246980b0072d51f956074e6b8ec5e2531ff9614ec9fd419b6eec
SSDEEP 768:hZZ6Zyf9LrsHM5s39vkq0xEOkhzQLX7v5uZn+5NlemmuLbR+PDl+JTs8SCd+CSPf:1eHpt8q03mUqaoPB8TvSrtXr1CNs9Bb
MD5 SHA1 SHA512 SSDEEP

Submit Download

iffehom-ofoot.exe

Path C:\Windows\SysWOW64\iffehom-ofoot.exe
Size 73KB
SHA256 0cda76e61df17494db4c55c302e46635eef90c6095e1b6c9823d9fd5ed71267d
MD5 b9d264475410fa3f296b9427017785d5
SHA1 4f1a91e6cf900a8fa7f805d0d81993ac0fae6d47
SHA512 e78e1d06634c50198045d494dd4eba5764f766b087f5c7790b48a5522d7fe9a1d94cd72aacf06cc1a69aeb40bcad834168bf05d1f50dfdbf40755f2890ee2cfc
SSDEEP 1536:xLUZP5UOEbZKaIzzRghmoJHla5jxLt5b4GCa5Ojz:iZPDEbEehmJCaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

odcoakug.dll

Path C:\Windows\SysWOW64\odcoakug.dll
Size 5KB
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

oudbavoaf.exe

Path \Windows\SysWOW64\oudbavoaf.exe
Size 70KB
SHA256 94e54aa6e82d9bfa8396a7d7465b27677bf785bd0408e16cd3237ea016ecb4c7
MD5 af8283a2b654ab00d5d20002794cbd00
SHA1 22b96401a9879e838509c36255aa4bdc6ef3f6ae
SHA512 371e8fe1e627d13f3117d3c77d264235d6ceee4e01c1d7fc029951736ab6a6069a9db8a6a279d213e30f4bf754491279f06c71695768fc0d821fd374ff091edc
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl6i:Olg35GTslA5t3/w87i
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1172-56-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2852-55-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2988-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download