6aa220e6642412e1adfdc52346f015dc153cb20afe411412dff8b68d20d8d22e

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics.dll
Size

338KB
MD5

c0fba00be389f3cf7b4e84253bf2d650
SHA1

fbf11b7979e5cdff81a3c116dcfcbf6f97d87e62
SHA256

6aa220e6642412e1adfdc52346f015dc153cb20afe411412dff8b68d20d8d22e
SHA512

73c244d0e4b0523b9a161569116c260f1ea7ef32669e16e8a7bd472f7619083e3eafbf2adcc8e53136cb69a36d71f4d9b7bd8b3d2e1670f3a013def2cdff8787
SSDEEP

6144:9eub42K2WDe5HOZAQT/hYSzQU++qSJJz4SVpwrqWkk4g4UZd8gZv:9BI2WvhbV1qSJJEIWEg4UZ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1196	regsvr32.exe
1196	regsvr32.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\ProgID\ = "FStock.Factoid.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4136535C-724B-4F68-AEC2-9A7917456384}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\TypeLib\ = "{4136535C-724B-4F68-AEC2-9A7917456384}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\ = "ISmartTagProperties"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\TypeLib\ = "{4136535C-724B-4F68-AEC2-9A7917456384}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid\ = "Factoid Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\TypeLib\ = "{4136535C-724B-4F68-AEC2-9A7917456384}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\ = "IAction"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\TypeLib\ = "{4136535C-724B-4F68-AEC2-9A7917456384}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid.1\ = "Factoid Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid\CLSID\ = "{06F9A697-9708-422D-A5AF-C559391A850A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\VersionIndependentProgID\ = "FStock.Factoid"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\ = "IAction"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid\CurVer\ = "FStock.Factoid.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FStock.Factoid.1\CLSID\ = "{06F9A697-9708-422D-A5AF-C559391A850A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\ = "Factoid Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06F9A697-9708-422D-A5AF-C559391A850A}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B744D8F-B8A5-11D3-B2CF-00500489D6A3}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\TypeLib\ = "{4136535C-724B-4F68-AEC2-9A7917456384}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1196	2020	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0fba00be389f3cf7b4e84253bf2d650_NeikiAnalytics.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:1196
- - C:\Users\Admin\AppData\Local\Temp\78E7.tmp
    C:\Users\Admin\AppData\Local\Temp\78E7.tmp
    3⤵
    PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\78E7.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/1196-0-0x0000000000170000-0x00000000001AA000-memory.dmp

Filesize
232KB

Download
memory/1196-1-0x0000000000170000-0x00000000001AA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads