Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/05/2024, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe
- Size 71KB
- Sample240514-hethqaec98
- SHA256 7b4afa64df13d5c80d8f98783ed34464bee7cedf9bb56766cd93dc0d4cb987b0
- MD5 967627d512ba68f5d73af30414b71620
- SHA1 d45c2f85ec296ff3cd3c3076ab238703aaf3222b
- SHA512 132e9596af48e2e5d89d744c05b801782634c1b39a0cf451aa8e45606667bbe83b2490052a852a1480c2fb57018e916b83151c2edcf8eeb88c18cea27dd65ee6
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slG:Olg35GTslA5t3/w8/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ousbudoah.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\kdexum.exe" ousbudoah.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\prutik.exe" ousbudoah.exe - Executes dropped EXE 2 IoCs
pid Process 3204 ousbudoah.exe 1144 ousbudoah.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ousbudoah.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ousbudoah.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ousbudoah.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\omgevit-emid.dll" ousbudoah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ousbudoah.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\prutik.exe ousbudoah.exe File opened for modification C:\Windows\SysWOW64\kdexum.exe ousbudoah.exe File opened for modification C:\Windows\SysWOW64\omgevit-emid.dll ousbudoah.exe File opened for modification C:\Windows\SysWOW64\ousbudoah.exe ousbudoah.exe File opened for modification C:\Windows\SysWOW64\ousbudoah.exe 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\prutik.exe ousbudoah.exe File created C:\Windows\SysWOW64\omgevit-emid.dll ousbudoah.exe File created C:\Windows\SysWOW64\ousbudoah.exe 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe File created C:\Windows\SysWOW64\kdexum.exe ousbudoah.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 1144 ousbudoah.exe 1144 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe 3204 ousbudoah.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3196 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe Token: SeDebugPrivilege 3204 ousbudoah.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 3204 3196 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe 82 PID 3196 wrote to memory of 3204 3196 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe 82 PID 3196 wrote to memory of 3204 3196 967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe 82 PID 3204 wrote to memory of 616 3204 ousbudoah.exe 5 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 1144 3204 ousbudoah.exe 83 PID 3204 wrote to memory of 1144 3204 ousbudoah.exe 83 PID 3204 wrote to memory of 1144 3204 ousbudoah.exe 83 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56 PID 3204 wrote to memory of 3448 3204 ousbudoah.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\967627d512ba68f5d73af30414b71620_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\ousbudoah.exe"C:\Windows\system32\ousbudoah.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\ousbudoah.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1144
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\kdexum.exe
- Size 73KB
- SHA256 c1f42d4c8d48349e158785311af361959782628db2b89680f4e08129adbc7ff8
- MD5 46fe6d36e27b856974374a4408f5f18b
- SHA1 0221fb66c5299d6f37966b6dc6e8196752124d0c
- SHA512 351202f86b20283145754c6999af1ae74dba1401d9c3d42610900c23624a2ceb1843419fbbb3152d24056e7a1e6e057de5b6d33676c56ff61d9966fa5fd383c6
- SSDEEP 1536:xng7HGJLCPg5WVjaNuRNgfxBcM8Q/Og4TpY:pg7mMUWVNgfxBh/OFTpY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\omgevit-emid.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ousbudoah.exe
- Size 71KB
- SHA256 7b4afa64df13d5c80d8f98783ed34464bee7cedf9bb56766cd93dc0d4cb987b0
- MD5 967627d512ba68f5d73af30414b71620
- SHA1 d45c2f85ec296ff3cd3c3076ab238703aaf3222b
- SHA512 132e9596af48e2e5d89d744c05b801782634c1b39a0cf451aa8e45606667bbe83b2490052a852a1480c2fb57018e916b83151c2edcf8eeb88c18cea27dd65ee6
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slG:Olg35GTslA5t3/w8/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\prutik.exe
- Size 74KB
- SHA256 71e5a336dccf119ffb8738ec2b43563da4903750fea5f76f2be33ea2eb274541
- MD5 ff2adf77a0696e552ffd88bbaccb656e
- SHA1 f6c03d4d228f793c8c3b4e70c93041e187af97ba
- SHA512 a81a52305a56b50b60fc59f20f412177a7ee68a21c12613d539f1f3cf8513c2cc3cacaca042f3fa339810669a7844eba4ed2a4df69009fcccb5cdba3a073673b
- SSDEEP 768:hZZ6Zyf9kOLN/xCc0dctPdom0zoEwxq0IEkBVayhtptDk5oSdPUeo0P/uUL6rUl1:1OOnr5IE6P1tAXDPf6YlIdU3ddPNT7yw
- MD5 SHA1 SHA512 SSDEEP