Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 13:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe
-
Size
72KB
-
MD5
bb625363dfd4352ec8a87b417ba50270
-
SHA1
ab23e674286169c0aa6dabb3a8c042aefaf8f3b0
-
SHA256
32598fcb7626280cc77475a92561ee15c19bc1a4db3e5ee79c293b420515ebd2
-
SHA512
9698174930eebe8173fd9e23a4c1f5436685274818bf0618cdafad468089c6923901e7475ea3cc3ebe29db1e1fe614a75f3edd267a5a508ded05289906341468
-
SSDEEP
768:x/nAevU3u+VNDkC0H9ALW/Z0dPWyYzTnLlNey1GJrDKkHMKejknCMBuQDXdT/fPq:xL8XDkBdUWcnYvnLl7PkHMFGu4XtPq
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" essixean-oucoas.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450} essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\onpumec.exe" essixean-oucoas.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oullosed-fix.exe" essixean-oucoas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe essixean-oucoas.exe -
Executes dropped EXE 2 IoCs
pid Process 2832 essixean-oucoas.exe 2940 essixean-oucoas.exe -
Loads dropped DLL 3 IoCs
pid Process 1460 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 1460 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 2832 essixean-oucoas.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" essixean-oucoas.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} essixean-oucoas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\uphecac-acex.dll" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" essixean-oucoas.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\essixean-oucoas.exe bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe File created C:\Windows\SysWOW64\oullosed-fix.exe essixean-oucoas.exe File opened for modification C:\Windows\SysWOW64\onpumec.exe essixean-oucoas.exe File opened for modification C:\Windows\SysWOW64\uphecac-acex.dll essixean-oucoas.exe File created C:\Windows\SysWOW64\uphecac-acex.dll essixean-oucoas.exe File created C:\Windows\SysWOW64\essixean-oucoas.exe bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\oullosed-fix.exe essixean-oucoas.exe File created C:\Windows\SysWOW64\onpumec.exe essixean-oucoas.exe File opened for modification C:\Windows\SysWOW64\essixean-oucoas.exe essixean-oucoas.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2940 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe 2832 essixean-oucoas.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2832 essixean-oucoas.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2832 1460 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 28 PID 1460 wrote to memory of 2832 1460 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 28 PID 1460 wrote to memory of 2832 1460 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 28 PID 1460 wrote to memory of 2832 1460 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 28 PID 2832 wrote to memory of 436 2832 essixean-oucoas.exe 5 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 2940 2832 essixean-oucoas.exe 29 PID 2832 wrote to memory of 2940 2832 essixean-oucoas.exe 29 PID 2832 wrote to memory of 2940 2832 essixean-oucoas.exe 29 PID 2832 wrote to memory of 2940 2832 essixean-oucoas.exe 29 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21 PID 2832 wrote to memory of 1224 2832 essixean-oucoas.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\essixean-oucoas.exe"C:\Windows\SysWOW64\essixean-oucoas.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\essixean-oucoas.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c612a4c7b7e45b5716258799c4f82318
SHA1556246cba54724ecbebbb2aab339f7d9ac8ffb79
SHA256e90f0d469795f2a61d157ea7b3a332bbb2793d0a5984924435e2eb6e34aad758
SHA512e1578e1ab6015eb5ff82352b5f95fd9379621b52638ee38244ec3bc231336caef8838c38ab55bdb140d6ea47839ead084a8d309ede0d8a7b3d1340b28d0616ad
-
Filesize
73KB
MD589fe2198b7d672c20a75007eab5c94f9
SHA1136d5461d1e1ee70bda7f6071373cc2a06b5e4f0
SHA256f93d2e7e2d431c9036485e7e8290fc30bdf6ddb651ce6f91dcfa66c724365d64
SHA512b0dfb6d91c3d4feee7fa1d5f9fea5a42460ff8d03e86c6afcb69f1937e202a7d382c81ef5399184270a51ccdef06c2ca025556cfba1d57a55aa42c335667c416
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
70KB
MD59f0c72ab712fa43e13a3d64a0854c075
SHA1de4902c1be2f38ce8b20f2fafb0a411e4777700f
SHA25690ee840e4a384721338f923d5d6ac227827abaf2044f7783765b7d52e810a153
SHA51237f4bc87da49beb818371853e1cd046c0c981e9098d7b144c33286f4b14d7557b390a4df77e12e75b0c262b3ec282539b102333489f78e0b818c7bdb8620bf68