Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe
-
Size
69KB
-
MD5
b2df6b5a140578849d603608e3223540
-
SHA1
6fdbdc31f0f5d1c80edf541c35373159f357f4bf
-
SHA256
933d434a1a7a52909c4fc87406cf182fd133c6eeea475acd27d37b64ea198054
-
SHA512
48b012da851d08b99d1d2aaa6856cfcd6bd345741b88c5cce4954bb2e5d66af73f3a12e8252f19b1f68ecd0600aec98796f9b449e036dac84f93651a89c3b660
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slx:Olg35GTslA5t3/w8Y
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" uvserib.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\IsInstalled = "1" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\StubPath = "C:\\Windows\\system32\\eaxvugum.exe" uvserib.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55} uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" uvserib.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ubvooron.exe" uvserib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" uvserib.exe -
Executes dropped EXE 2 IoCs
pid Process 2984 uvserib.exe 4852 uvserib.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" uvserib.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" uvserib.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\esfosoar-oucoab.dll" uvserib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" uvserib.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} uvserib.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify uvserib.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\eaxvugum.exe uvserib.exe File opened for modification C:\Windows\SysWOW64\esfosoar-oucoab.dll uvserib.exe File created C:\Windows\SysWOW64\esfosoar-oucoab.dll uvserib.exe File opened for modification C:\Windows\SysWOW64\uvserib.exe uvserib.exe File opened for modification C:\Windows\SysWOW64\uvserib.exe b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe File created C:\Windows\SysWOW64\uvserib.exe b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ubvooron.exe uvserib.exe File created C:\Windows\SysWOW64\ubvooron.exe uvserib.exe File created C:\Windows\SysWOW64\eaxvugum.exe uvserib.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 4852 uvserib.exe 4852 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe 2984 uvserib.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1884 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe Token: SeDebugPrivilege 2984 uvserib.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2984 1884 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 81 PID 1884 wrote to memory of 2984 1884 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 81 PID 1884 wrote to memory of 2984 1884 b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe 81 PID 2984 wrote to memory of 612 2984 uvserib.exe 5 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 4852 2984 uvserib.exe 82 PID 2984 wrote to memory of 4852 2984 uvserib.exe 82 PID 2984 wrote to memory of 4852 2984 uvserib.exe 82 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56 PID 2984 wrote to memory of 3456 2984 uvserib.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b2df6b5a140578849d603608e3223540_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\uvserib.exe"C:\Windows\system32\uvserib.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\uvserib.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD57ebecd3d1a506783ee91c780d688fa06
SHA1c37229d7e95df1d9b489ed1d835b3ddcb1308150
SHA256387a88c7c25737794ee3f44a87475f9b657041555abc0ee60968aecac8afb358
SHA5123bc03d19f897aff04e29aae105dcb69230154b073cfea8d0bb39e63c040c0696ab7ee0322252314ddc4b76fccfade2ceab740e57c02e6616fb54220dee110deb
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD5319d6258e3103a81623c79765e85dccc
SHA19770f17e186bc7a2a95049f37ad382dcc2350323
SHA256647f3a7e392a96963a28db275d82a62e032b57e490c2d22d46dd3a58a96534ea
SHA512d802b6b02fba3d9c8811f43490bf07e48376f8d0436214075c9fbacfe0783b6fc4000bbecfb3e6860e24936f35e6823c56a66da39ba7887f1f930cffd8fb7718
-
Filesize
69KB
MD5b2df6b5a140578849d603608e3223540
SHA16fdbdc31f0f5d1c80edf541c35373159f357f4bf
SHA256933d434a1a7a52909c4fc87406cf182fd133c6eeea475acd27d37b64ea198054
SHA51248b012da851d08b99d1d2aaa6856cfcd6bd345741b88c5cce4954bb2e5d66af73f3a12e8252f19b1f68ecd0600aec98796f9b449e036dac84f93651a89c3b660