Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 09:00
Behavioral task
behavioral1
Sample
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe
-
Size
130KB
-
MD5
b58804265808bf73ad4eb3e0d510f490
-
SHA1
272794ba4a05469e5eb5c563979031af08ead4ca
-
SHA256
4a3cc1cbc426429efc7531a88f2e76509dbb35d5a397ea4ce450e072008ac021
-
SHA512
523e52e4e4ceca15fd18af4385386f8b4604375fa48db5b120558b89b81cf46c9f9e29a78c9c09d88f20a28b76061ca68b96cfd2d6aaa1c5fb9a0bc537750e34
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZM:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKe
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1052-46-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1052-50-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1052-48-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1052-52-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1052-55-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1052-60-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 3160 Flaseher.exe 3740 Flaseher.exe 1052 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/780-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2916-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2916-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/780-10-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2916-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2916-14-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/3160-35-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3160-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3160-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3160-44-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2916-54-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3160-56-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2916-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3740-59-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 780 set thread context of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 3160 set thread context of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 set thread context of 1052 3160 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe Token: SeDebugPrivilege 3740 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exeb58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe 3160 Flaseher.exe 3740 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exeb58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 780 wrote to memory of 2916 780 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe PID 2916 wrote to memory of 1660 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe cmd.exe PID 2916 wrote to memory of 1660 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe cmd.exe PID 2916 wrote to memory of 1660 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe cmd.exe PID 1660 wrote to memory of 2204 1660 cmd.exe reg.exe PID 1660 wrote to memory of 2204 1660 cmd.exe reg.exe PID 1660 wrote to memory of 2204 1660 cmd.exe reg.exe PID 2916 wrote to memory of 3160 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe Flaseher.exe PID 2916 wrote to memory of 3160 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe Flaseher.exe PID 2916 wrote to memory of 3160 2916 b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 3740 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe PID 3160 wrote to memory of 1052 3160 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b58804265808bf73ad4eb3e0d510f490_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EJYWF.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EJYWF.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD504397b80bc9daedee3d9f7a18f956e69
SHA152e83e50d65b29cda768f980897aa675c45b30ef
SHA25602211b1e4938b36b88b39fa84b68b8f2c5187789b127f8f291474ef273adf518
SHA5122d6cb6d7465c34a0e54db6c807f4b93457e86c99497055b04908e1a36671a651bdd1e763377e9f889cba7448857dc628a53fda4abc4244a28026e9b6329c2d8c
-
memory/780-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/780-3-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/780-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/780-10-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/780-4-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/780-5-0x0000000002AE0000-0x0000000002AE1000-memory.dmpFilesize
4KB
-
memory/1052-60-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1052-46-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1052-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1052-52-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1052-48-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1052-50-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2916-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2916-14-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2916-54-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2916-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2916-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2916-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3160-44-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3160-40-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3160-39-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3160-35-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3160-56-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3740-59-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB