Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe
-
Size
69KB
-
MD5
b2df6b5a140578849d603608e3223540
-
SHA1
6fdbdc31f0f5d1c80edf541c35373159f357f4bf
-
SHA256
933d434a1a7a52909c4fc87406cf182fd133c6eeea475acd27d37b64ea198054
-
SHA512
48b012da851d08b99d1d2aaa6856cfcd6bd345741b88c5cce4954bb2e5d66af73f3a12e8252f19b1f68ecd0600aec98796f9b449e036dac84f93651a89c3b660
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slx:Olg35GTslA5t3/w8Y
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" uvserib.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255} uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255}\IsInstalled = "1" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255}\StubPath = "C:\\Windows\\system32\\eaxvugum.exe" uvserib.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ubvooron.exe" uvserib.exe -
Executes dropped EXE 2 IoCs
pid Process 2588 uvserib.exe 2504 uvserib.exe -
Loads dropped DLL 3 IoCs
pid Process 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 2588 uvserib.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" uvserib.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} uvserib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\esfosoar-oucoab.dll" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" uvserib.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\eaxvugum.exe uvserib.exe File opened for modification C:\Windows\SysWOW64\uvserib.exe uvserib.exe File opened for modification C:\Windows\SysWOW64\uvserib.exe b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ubvooron.exe uvserib.exe File created C:\Windows\SysWOW64\ubvooron.exe uvserib.exe File opened for modification C:\Windows\SysWOW64\eaxvugum.exe uvserib.exe File opened for modification C:\Windows\SysWOW64\esfosoar-oucoab.dll uvserib.exe File created C:\Windows\SysWOW64\esfosoar-oucoab.dll uvserib.exe File created C:\Windows\SysWOW64\uvserib.exe b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2504 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe 2588 uvserib.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe Token: SeDebugPrivilege 2588 uvserib.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2588 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2588 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2588 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2588 2172 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 28 PID 2588 wrote to memory of 436 2588 uvserib.exe 5 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 2504 2588 uvserib.exe 29 PID 2588 wrote to memory of 2504 2588 uvserib.exe 29 PID 2588 wrote to memory of 2504 2588 uvserib.exe 29 PID 2588 wrote to memory of 2504 2588 uvserib.exe 29 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20 PID 2588 wrote to memory of 1112 2588 uvserib.exe 20
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\uvserib.exe"C:\Windows\system32\uvserib.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\uvserib.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD55baea26ba695dd8856554f41400d728d
SHA12fb9bb638307fc87bde4c8300e50c9722058ea95
SHA256cd782abeef405f7357bff12eb656b7b8a66e7727771b8f10698cd9971e5f8caa
SHA512be2e84e0325e5c73e0d27d2603609cdb35d245dcac071d8b9be8cd00c280d1dbe6cb8dba779d349c8f376dbb5ae013d18d2cc394f8ad141b0c1da4f8f6fe53cf
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD54210e5600a581713e752d93ab7bfb212
SHA1a9c541a03b4bc719528f16d7e922f6f4be1d4924
SHA256c5df7872c6644b5495e45413e4e3d087d660ea7b75489c306c1f180efee50b6a
SHA5129eb13953ba88fad008ff9191047d75f82f8fc9298628f97ed37b5412b85001246ef8cd439e054d9fa4f07d3793c1b11b57a942f1ebd3ab53a25e8f384f2a2061
-
Filesize
69KB
MD5b2df6b5a140578849d603608e3223540
SHA16fdbdc31f0f5d1c80edf541c35373159f357f4bf
SHA256933d434a1a7a52909c4fc87406cf182fd133c6eeea475acd27d37b64ea198054
SHA51248b012da851d08b99d1d2aaa6856cfcd6bd345741b88c5cce4954bb2e5d66af73f3a12e8252f19b1f68ecd0600aec98796f9b449e036dac84f93651a89c3b660