Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 06:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe
-
Size
73KB
-
MD5
9ba553bfec8fa5baf731987c80f42290
-
SHA1
11fd555fc81918cecb6fea2f1306adbe807e1d95
-
SHA256
c210eba07f356e5b67c81010c5f9a4d09fab358062e5dc96fcd47fe24ca8c972
-
SHA512
57b4dd86a6661a50edb06f935eb93c8a49b9ae844777a34683ef13ce43e739908e917de2334bd5e957b1f1bafa257eda1f77451f2158da4e86e9b5d306027a60
-
SSDEEP
1536:xnQYxd5ngUaB4tcVsfDGwZSk3QDTcFMxTGigP+LN3P78XsGyelTf4JPs:f1EvMCTyI/ksGySz4Bs
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oudluveav-emur.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55} oudluveav-emur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\IsInstalled = "1" oudluveav-emur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\StubPath = "C:\\Windows\\system32\\iffikuv-adoot.exe" oudluveav-emur.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe oudluveav-emur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" oudluveav-emur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eaclunud-ukur.exe" oudluveav-emur.exe -
Executes dropped EXE 2 IoCs
pid Process 1632 oudluveav-emur.exe 3932 oudluveav-emur.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oudluveav-emur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oudluveav-emur.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" oudluveav-emur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eatnoatoat-adeab.dll" oudluveav-emur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" oudluveav-emur.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} oudluveav-emur.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify oudluveav-emur.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\oudluveav-emur.exe 9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe File created C:\Windows\SysWOW64\iffikuv-adoot.exe oudluveav-emur.exe File opened for modification C:\Windows\SysWOW64\eatnoatoat-adeab.dll oudluveav-emur.exe File opened for modification C:\Windows\SysWOW64\oudluveav-emur.exe 9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\eaclunud-ukur.exe oudluveav-emur.exe File created C:\Windows\SysWOW64\eaclunud-ukur.exe oudluveav-emur.exe File opened for modification C:\Windows\SysWOW64\iffikuv-adoot.exe oudluveav-emur.exe File created C:\Windows\SysWOW64\eatnoatoat-adeab.dll oudluveav-emur.exe File opened for modification C:\Windows\SysWOW64\oudluveav-emur.exe oudluveav-emur.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 3932 oudluveav-emur.exe 3932 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe 1632 oudluveav-emur.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1632 oudluveav-emur.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 808 wrote to memory of 1632 808 9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe 81 PID 808 wrote to memory of 1632 808 9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe 81 PID 808 wrote to memory of 1632 808 9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe 81 PID 1632 wrote to memory of 612 1632 oudluveav-emur.exe 5 PID 1632 wrote to memory of 3932 1632 oudluveav-emur.exe 82 PID 1632 wrote to memory of 3932 1632 oudluveav-emur.exe 82 PID 1632 wrote to memory of 3932 1632 oudluveav-emur.exe 82 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56 PID 1632 wrote to memory of 3456 1632 oudluveav-emur.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9ba553bfec8fa5baf731987c80f42290_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\oudluveav-emur.exe"C:\Windows\SysWOW64\oudluveav-emur.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\oudluveav-emur.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3932
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD554c65bc5e06718273738febbd656764b
SHA19daed19fd8f86029e634860ea3610ca97d7a4d51
SHA2562638b129874972b7bb6b25029d1ace45df4dce464f57b511fc274cb6cdb80913
SHA51219cfa6cd53ceb5ad019466afbe31c8c0aeedc7b8d55fe35aafac41c91d00a6775a0fb6ef7c9b31ef6c2c33aff0f7fc393c9e5faa9bc3424f753653fdd67e77ee
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD5ee87ef7aa2744d51959e4a143f3eb62e
SHA1bfe757e7fca5bcc518c7dbf054ea79eccff664c7
SHA256bed43dec46520d5fe6fb0793ebfac29b3aed132269713aaa4bb02599f7c16238
SHA5126bedd8672e4b80837e12fd0b696bb7e2f2548928abaf448ed63cb7af466d6c0578ea5326e67b32a4ff7cc692f7377d0d597f17544b56be23ad73c161ace5330b
-
Filesize
71KB
MD5bbee84939cdb588c99a1a6aa03aca9c7
SHA1a99ed32a6e63a1868a0bb2d7d409af62cdc389ab
SHA256dce38b31ecbc413c4a27a74c770920010ef70bcdb5bb34c6e97c0fbf11d273ad
SHA51240e1dc4bfb2d11cca09398c6a10b324e06fb4bc1ff583be2e83f73dbf7419248fbc16f18340f6f53b1fe5acaa0541fc71e988617e78bcf659ee251971597d3ae