Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 13:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe
-
Size
70KB
-
MD5
b9ad4481560f36da3fb203e1a0128940
-
SHA1
cfed8160c4e9f9fd94cfbd23f6044d79ba99d9a5
-
SHA256
2a370d3d80e1a11bb48fe5f7abe69387540931269ff9dd7bf151936f93f4370e
-
SHA512
d51aef5b2d769f7cd9396574bcf72d4701b75dc7838edd887707f644eb2a4bc7a5273365f0c760a5a80b0ec6a4245cf64c798ccffb3b030a936151b530f9d65b
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl0:Olg35GTslA5t3/w8H
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ubhutat.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c} ubhutat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\IsInstalled = "1" ubhutat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\StubPath = "C:\\Windows\\system32\\oubmeafeas.exe" ubhutat.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\opcooteax-evex.exe" ubhutat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ubhutat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ubhutat.exe -
Executes dropped EXE 2 IoCs
pid Process 2856 ubhutat.exe 1032 ubhutat.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ubhutat.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ubhutat.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\avbootoog.dll" ubhutat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ubhutat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ubhutat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ubhutat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ubhutat.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ubhutat.exe b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ubhutat.exe b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\opcooteax-evex.exe ubhutat.exe File created C:\Windows\SysWOW64\opcooteax-evex.exe ubhutat.exe File created C:\Windows\SysWOW64\avbootoog.dll ubhutat.exe File opened for modification C:\Windows\SysWOW64\ubhutat.exe ubhutat.exe File opened for modification C:\Windows\SysWOW64\oubmeafeas.exe ubhutat.exe File created C:\Windows\SysWOW64\oubmeafeas.exe ubhutat.exe File opened for modification C:\Windows\SysWOW64\avbootoog.dll ubhutat.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 1032 ubhutat.exe 1032 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe 2856 ubhutat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3160 b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe Token: SeDebugPrivilege 2856 ubhutat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2856 3160 b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe 84 PID 3160 wrote to memory of 2856 3160 b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe 84 PID 3160 wrote to memory of 2856 3160 b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe 84 PID 2856 wrote to memory of 612 2856 ubhutat.exe 5 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 1032 2856 ubhutat.exe 85 PID 2856 wrote to memory of 1032 2856 ubhutat.exe 85 PID 2856 wrote to memory of 1032 2856 ubhutat.exe 85 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56 PID 2856 wrote to memory of 3484 2856 ubhutat.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9ad4481560f36da3fb203e1a0128940_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\ubhutat.exe"C:\Windows\system32\ubhutat.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\ubhutat.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
74KB
MD584deeb27e988a5678fa524d2afcd2c99
SHA1a25b6b0afae16a0fcc94ce980498079b903f0100
SHA25688c228fb886a3cb9a2cb7e7ccb4768ee6baeed8da7d50af887a2036fc1c7cd07
SHA5124fa2dae977ad7f1bffc8ae20b665f76cb308d248245550a99fd9719d294e47759d86253be9b3c8ed803e25090faff4425dc6e339e8271e4e2ef7f11f582ea2e5
-
Filesize
72KB
MD54b86b25d19cec47de838c20ae9dc1983
SHA19d7b5670477fa97af943e5b88761541760baad74
SHA256e3360de787791a8d9b0e9d3f3c611ef1fa6aedec8f214637e9116986fdf5f562
SHA512eed903c5494b771700c78c198c7fb259f2bb9b33ff84e721550220f638a68d22025fd51861ba0a12253065b14b3c2f64b5c8b053054d60e613587c5f1b863586
-
Filesize
70KB
MD5b9ad4481560f36da3fb203e1a0128940
SHA1cfed8160c4e9f9fd94cfbd23f6044d79ba99d9a5
SHA2562a370d3d80e1a11bb48fe5f7abe69387540931269ff9dd7bf151936f93f4370e
SHA512d51aef5b2d769f7cd9396574bcf72d4701b75dc7838edd887707f644eb2a4bc7a5273365f0c760a5a80b0ec6a4245cf64c798ccffb3b030a936151b530f9d65b