Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 10:33

General

  • Target

    b2c530383049901ba8715981c0c79cb0_NeikiAnalytics.exe

  • Size

    211KB

  • MD5

    b2c530383049901ba8715981c0c79cb0

  • SHA1

    21f3d4ddb62bdf4f920512e0c4aaa0666f7826a8

  • SHA256

    0a2af68859bc99d653c9a97fa617e77ad71c81dfa3c3789ef9366459ec9cab46

  • SHA512

    8e493cefd59cb5190c398a7cfc32780aff610c29b555b5a222b83b9f071ec5a7b72f4c7efd3fe43889b0734464e62d406add95229b3cdaa88d2ec8d4830c0a3f

  • SSDEEP

    3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOk:Jh8cBzHLRMpZ4d1Zk

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2c530383049901ba8715981c0c79cb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\b2c530383049901ba8715981c0c79cb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4492
    • \??\c:\windows\userinit.exe
      c:\windows\userinit.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4952
      • \??\c:\windows\spoolsw.exe
        c:\windows\spoolsw.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2980
        • \??\c:\windows\swchost.exe
          c:\windows\swchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:432
          • \??\c:\windows\spoolsw.exe
            c:\windows\spoolsw.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4660

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\mrsys.exe

          Filesize

          211KB

          MD5

          14e8b89fae8537e2bdc541301f1ce044

          SHA1

          5b1296a1c1f665ff154c39da7dd9d1998f14090a

          SHA256

          89b090b537221f2c3f9c524a56265d3f8d7a2c048b1083407601ef81cf817002

          SHA512

          249eaf4e5b577b9b2cfef40d52e20c50019ee3621881e1734444ece56264748efec7bd0da6ed99accdfb1813f6cfa7e84c09006573066c081d330787a1bf4193

        • C:\Windows\spoolsw.exe

          Filesize

          211KB

          MD5

          59ed49ba1acfdfdf9b00e35582deac13

          SHA1

          1393a03b9c5c1c3e6c7783e21256f94241e11ef7

          SHA256

          602e11e780ac05d18b6c5eda633516b374aa5a55b34057b17984080e4cf10f9f

          SHA512

          111113a3ed3291680dd2469efe2ab1ef451ca0ae4882d2da0e38f694062dd310fda50d7ac3d9d18b75f06a8ed18e1b4b5882c1ccdaaf5185a43cf000d4571690

        • C:\Windows\swchost.exe

          Filesize

          211KB

          MD5

          0fd53134d6b9a1456389aa60bf43ecc7

          SHA1

          f86f2881b2b3b082cb2a9b5fe14b8a0c9b942705

          SHA256

          4b05a005064b9f01fe889438816e18c3752a73c784ccfcca7be5d2b4a1aae37e

          SHA512

          91b5cb4f95e8eeeb20c98c399518fbcbbce08379c6ff964f28d5647453e356568ef52a013778662919dcf43bef4f8c3711b93ce6d4053d6176e7bad730187ace

        • C:\Windows\userinit.exe

          Filesize

          211KB

          MD5

          c652131cd6352ca47ca11c8ce59bce4c

          SHA1

          3aee04ba3fc8f978d1425b8b906d496a4a5d078c

          SHA256

          972fef7cf9e6c6102baf0412b787ae759287d52973dbc3e36d8d9f5d0a6a7e3c

          SHA512

          f0fed52968864bf6cf8a64ac97ce9555f6c4068e604d39aa62cd3c0204188cebeeedfcf0d50f4991fe1be8f2f8f719bd09147309ab448490fea70e264e7c8df7