Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 13:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe
-
Size
72KB
-
MD5
bb625363dfd4352ec8a87b417ba50270
-
SHA1
ab23e674286169c0aa6dabb3a8c042aefaf8f3b0
-
SHA256
32598fcb7626280cc77475a92561ee15c19bc1a4db3e5ee79c293b420515ebd2
-
SHA512
9698174930eebe8173fd9e23a4c1f5436685274818bf0618cdafad468089c6923901e7475ea3cc3ebe29db1e1fe614a75f3edd267a5a508ded05289906341468
-
SSDEEP
768:x/nAevU3u+VNDkC0H9ALW/Z0dPWyYzTnLlNey1GJrDKkHMKejknCMBuQDXdT/fPq:xL8XDkBdUWcnYvnLl7PkHMFGu4XtPq
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" essixean-oucoas.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\onpumec.exe" essixean-oucoas.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oullosed-fix.exe" essixean-oucoas.exe -
Executes dropped EXE 2 IoCs
pid Process 1544 essixean-oucoas.exe 856 essixean-oucoas.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" essixean-oucoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" essixean-oucoas.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} essixean-oucoas.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\uphecac-acex.dll" essixean-oucoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" essixean-oucoas.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\oullosed-fix.exe essixean-oucoas.exe File opened for modification C:\Windows\SysWOW64\onpumec.exe essixean-oucoas.exe File created C:\Windows\SysWOW64\onpumec.exe essixean-oucoas.exe File opened for modification C:\Windows\SysWOW64\essixean-oucoas.exe essixean-oucoas.exe File opened for modification C:\Windows\SysWOW64\essixean-oucoas.exe bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\oullosed-fix.exe essixean-oucoas.exe File created C:\Windows\SysWOW64\uphecac-acex.dll essixean-oucoas.exe File created C:\Windows\SysWOW64\essixean-oucoas.exe bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\uphecac-acex.dll essixean-oucoas.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 856 essixean-oucoas.exe 856 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe 1544 essixean-oucoas.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1544 essixean-oucoas.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 1544 1328 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 82 PID 1328 wrote to memory of 1544 1328 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 82 PID 1328 wrote to memory of 1544 1328 bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe 82 PID 1544 wrote to memory of 856 1544 essixean-oucoas.exe 83 PID 1544 wrote to memory of 856 1544 essixean-oucoas.exe 83 PID 1544 wrote to memory of 856 1544 essixean-oucoas.exe 83 PID 1544 wrote to memory of 616 1544 essixean-oucoas.exe 5 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56 PID 1544 wrote to memory of 3580 1544 essixean-oucoas.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bb625363dfd4352ec8a87b417ba50270_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\essixean-oucoas.exe"C:\Windows\SysWOW64\essixean-oucoas.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\essixean-oucoas.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD59f0c72ab712fa43e13a3d64a0854c075
SHA1de4902c1be2f38ce8b20f2fafb0a411e4777700f
SHA25690ee840e4a384721338f923d5d6ac227827abaf2044f7783765b7d52e810a153
SHA51237f4bc87da49beb818371853e1cd046c0c981e9098d7b144c33286f4b14d7557b390a4df77e12e75b0c262b3ec282539b102333489f78e0b818c7bdb8620bf68
-
Filesize
72KB
MD5629ed5671b7d497bc23a7d9143ad8bd7
SHA1838bcdf8d3aa623703b69193dc1e6391edcd1078
SHA256bce9c952b04b13935735bc0360dab867099d749b99e352c0c66cee3cb27b5d73
SHA51266a04e2366389acb06ed5831a5c47a6f77ecece4506c6a93e767da1922e9ff59673dbcc16600b442a2f39529d58fc97c673215b3d75dc0c2ffa1d3f4e1deceae
-
Filesize
73KB
MD541a69364e893fa04aa82326304e01917
SHA15c55257ab0d7c7c2fb0d339e07dd820da1361211
SHA256ad45ef1af7942e778213456cfd27bdf3b099d2a7a6dfd15e08ef8143b2ea9300
SHA5129bf68b0068e8190c584d40f985d92b1d8a92f82b1bee294c812a351d7ea4a338143670ca113850024beab86a633af2167eeaf568d7e47028accf602d86e1eeb5
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4