Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe
-
Size
264KB
-
MD5
b2bd2f570c02742f139afa131ed0f1f0
-
SHA1
acf26b6f0e79921aa8274b13ec022c22c11c3a3f
-
SHA256
2f99885724e423b64ea264baab4dae2e2259f17711e904876d221d809a834e21
-
SHA512
bd59e311c3f0b045609c4478ada62a5e7a6d430484debbb3d0986de843cc30b6107318f5e9356900702fdcbf2479781cb1f71cfd34259a7ee3c4165a960d4c6a
-
SSDEEP
6144:I9hVQkyyUf9dgAVRKlqBiErIsKnPmb7/jWal+FfAje+1/pxiOsutOSD/uP39uWyJ:I96yUf9DRKlqgErIsKnPmb7/jWa1e+1x
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taiob.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 5016 taiob.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /r" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /n" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /k" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /s" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /M" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /p" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /t" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /w" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /g" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /x" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /R" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /Y" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /u" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /K" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /q" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /h" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /a" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /O" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /E" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /U" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /i" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /c" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /F" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /X" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /b" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /H" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /T" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /y" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /v" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /S" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /N" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /C" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /D" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /f" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /d" b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /A" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /d" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /Z" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /W" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /B" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /m" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /I" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /P" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /G" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /V" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /z" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /e" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /j" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /L" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /l" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /J" taiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taiob = "C:\\Users\\Admin\\taiob.exe /o" taiob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe 896 b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe 5016 taiob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 896 b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe 5016 taiob.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 896 wrote to memory of 5016 896 b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe 87 PID 896 wrote to memory of 5016 896 b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe 87 PID 896 wrote to memory of 5016 896 b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2bd2f570c02742f139afa131ed0f1f0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\taiob.exe"C:\Users\Admin\taiob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5ca9cb8a77d6d541fd3d04792c147e28e
SHA1a3dd06bc153e559ae93bcdcd857393d834699ae5
SHA256718671fc8db9c2bf34bf8113c92a1ac625a20ec4cbd6eaff0ddf6f2a37279d84
SHA51244a28762850a8828c2750008b888a1c4ba282ce05af057a19b23fd60ab55bd3d863b71169c48a95c5e8a202662a0de1418a6212da2c77bba799d0a5e843a5757