Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 23:31
Static task
static1
Behavioral task
behavioral1
Sample
5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe
-
Size
942KB
-
MD5
5485edc8665d579fbda79fdc41994e30
-
SHA1
6f50abd407459275ce42ae7412bb1dfb2dab9175
-
SHA256
121ef002202206856e19afceb25fa33f94e5ac1d35ce0d186313d9cda6b7e5ad
-
SHA512
67ddd1a2e2ecf564ba197b14726cdd2403ea29fe92a28546b0cc50621425933eff2dc9539d4724108c915c468d20c50b14ccdfb3683dd498a8002edaa1f79840
-
SSDEEP
12288:TjjwULQoN84XQT08JoVgWwAkAQGjjwULQoN84XQT08JoVgWwAkAQ:XEAy03kpWEAy03kp
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0007000000015d07-20.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1316 dllhost.exe -
Loads dropped DLL 1 IoCs
pid Process 2312 Regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DYWJN.EXE = "C:\\Windows\\sppsvc.exe" 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\O: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\Q: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\S: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\T: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\E: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\J: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\K: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\V: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\U: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\M: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\N: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\R: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\G: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\I: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\P: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File opened (read-only) \??\H: 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\WMTAETQ.EXE 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Ms7002.dll 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\dllhost.exe 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File created C:\Windows\OZVYTDZ.EXE 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe File created C:\Windows\sppsvc.exe 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe -
Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\$Recycle.Bin\\DWO.EXE %1" 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\$Recycle.Bin\\DWO.EXE \"%1\"" 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid\ = "{7CD4138D-4147-420B-9749-00A13B526785}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\$Recycle.Bin\\DWO.EXE \"%1\"" 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ = "C:\\Windows\\SysWow64\\Ms7002.dll" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\$Recycle.Bin\\DWO.EXE %1" 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID\ = "Ms7002.ShellExecuteHook" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile\qp7002 = "C:\\Windows\\SysWow64\\WMTAETQ.EXE" 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\ = "MaiHook7002" Regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1316 dllhost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 2312 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 28 PID 328 wrote to memory of 1316 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 29 PID 328 wrote to memory of 1316 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 29 PID 328 wrote to memory of 1316 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 29 PID 328 wrote to memory of 1316 328 5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5485edc8665d579fbda79fdc41994e30_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2312
-
-
C:\Windows\dllhost.exeC:\Windows\dllhost.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
943KB
MD5359f83e2bbbf0533ae5bae7950761290
SHA19216e702ba596e526136d6009dfe1c8c08b58a74
SHA256a69ccf5b2ab356d3723f383a4e656e241108939b5c8c2b00ba90d4cbbfe2312e
SHA512ee49f319ac1ae67747f7931323dfc65c592ffc705baeedbd3ca351eb1162b5a249b9c213cefd333a36945d832df69b7c5326446aa327a360a00f821eb47a8dd9
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1
-
Filesize
943KB
MD5188e11b61ecf2ec6a0ce10515521a834
SHA1f0ddef6a2b72406ce30cb486fbd74cd1a9136b5d
SHA25612f85d03fa81bceaf78d8accdcd8a1875a43b591345530474e440cddaadc1c42
SHA512dc01256d4722e2fc63e38e5f93248784648ad6c6f8620a96e9d01043d4bd4b0dd45d5345ec130d89d8b42a920e1574847c06fa8976776f569bb89ef19bcfc3c3