Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe
-
Size
296KB
-
MD5
c804e1118b565b034f44b70769b15740
-
SHA1
adc80ba2cc2eb562a70bc8d37828c6b8923eea3f
-
SHA256
228ad8f4ed8c6c05e5d241529e2ce4206bbb4e6eed89fdf21756ad14be8b1131
-
SHA512
7799427e1f07c19f53b679b39b9fbbf930a0864125d95681252d09dec60f192ba0ecffd4ed60d9139d8735935786b8acdb74b24a17359ea336be891e77ddf8cb
-
SSDEEP
6144:L2bFRcuJcCC2lfKgO32mO1IdifegrSQOJMmSnxtAPUWJj9/P/oEAlu9UY6L6P:LiPTCqmjZHJFnPnp6l2UuP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duuxiin.exe -
Executes dropped EXE 1 IoCs
pid Process 1272 duuxiin.exe -
Loads dropped DLL 2 IoCs
pid Process 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /u" c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /b" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /z" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /r" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /x" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /n" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /m" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /h" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /e" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /l" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /y" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /u" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /c" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /g" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /i" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /q" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /v" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /a" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /k" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /d" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /p" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /j" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /o" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /s" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /w" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /f" duuxiin.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\duuxiin = "C:\\Users\\Admin\\duuxiin.exe /t" duuxiin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe 1272 duuxiin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 1272 duuxiin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1272 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 1272 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 1272 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 28 PID 3068 wrote to memory of 1272 3068 c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c804e1118b565b034f44b70769b15740_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\duuxiin.exe"C:\Users\Admin\duuxiin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD56ec088a4f9b5d735781af9875239d4a5
SHA1ac7df0d6d6ea49a86a6459cb912b2ffd20c71e8a
SHA256e9bbad4ac4eab99a279add73143438ae321d6963586e46dfeff22a169dad3f30
SHA512239db1523913337a5343beaaaf008c59b0bdfdaacd3791aabe31ce14ca7e7a854599c34a0d5c6e91dce2f88ebd0af370a69731e7f868cdbe1b5282737dfeddc0