8c660815f34f2cdb08da1aad0c95b27f6288e8cc58d27067b5209998f7556292

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
Size

70KB
MD5

5579273ec1bb0bbdb06aeeffb1899f30
SHA1

ec527c45d2b3ddac3586a417cb6ad53f09b574e9
SHA256

8c660815f34f2cdb08da1aad0c95b27f6288e8cc58d27067b5209998f7556292
SHA512

0a04fc2684a3c2d0ec06ff50ae68f3830865bd1117d0854fad0c72c2372a1b8a82abd578c7090ebab532e6d6b912a3be475e57f40f6b235b0e550ca2e7886787
SSDEEP

1536:x+Yh85gHOEutUKZKEHfmWqk0AEPGER3ZajZ0b:fh3HOEuaWKE+/RA87R64

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	etgeateas.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}\IsInstalled = "1"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}\StubPath = "C:\\Windows\\system32\\adsukat.exe"	etgeateas.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ovdarav.exe"	etgeateas.exe

Executes dropped EXE 2 IoCs

pid	Process
2200	etgeateas.exe
2536	etgeateas.exe

Loads dropped DLL 3 IoCs

pid	Process
2360	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
2360	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
2200	etgeateas.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	etgeateas.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	etgeateas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eacxoohes-kur.dll"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	etgeateas.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\adsukat.exe	etgeateas.exe
File created	C:\Windows\SysWOW64\adsukat.exe	etgeateas.exe
File opened for modification	C:\Windows\SysWOW64\eacxoohes-kur.dll	etgeateas.exe
File created	C:\Windows\SysWOW64\eacxoohes-kur.dll	etgeateas.exe
File opened for modification	C:\Windows\SysWOW64\etgeateas.exe	etgeateas.exe
File opened for modification	C:\Windows\SysWOW64\etgeateas.exe	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\etgeateas.exe	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ovdarav.exe	etgeateas.exe
File created	C:\Windows\SysWOW64\ovdarav.exe	etgeateas.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2536	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe
2200	etgeateas.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	etgeateas.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2200	2360	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 2200	2360	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 2200	2360	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	28
PID 2360 wrote to memory of 2200	2360	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	28
PID 2200 wrote to memory of 436	2200	etgeateas.exe	5
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 2536	2200	etgeateas.exe	29
PID 2200 wrote to memory of 2536	2200	etgeateas.exe	29
PID 2200 wrote to memory of 2536	2200	etgeateas.exe	29
PID 2200 wrote to memory of 2536	2200	etgeateas.exe	29
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21
PID 2200 wrote to memory of 1372	2200	etgeateas.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\etgeateas.exe
    "C:\Windows\SysWOW64\etgeateas.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\etgeateas.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\adsukat.exe

Filesize
70KB

MD5
a989195553b7e4ff428fd6844d3002bc

SHA1
f8839fe72a58471093c7c6a3e996739b9e8ca84f

SHA256
bb991093d9f6bf74192450293c49ec693487c0b04a01dbb9063263b64067dc0f

SHA512
3c2a738907b760ebbca6f752a428fe0959722ee62e67fca7c4f9889924d19c40e242382acd6b0e8ec157272ceafe266d4ab42a85a04996d83ca37b555ac87f19

Download Submit
C:\Windows\SysWOW64\eacxoohes-kur.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ovdarav.exe

Filesize
71KB

MD5
830b03e51726cb03b02bbdf94929b728

SHA1
0dcc583056f9aac6920509e6756c7ef04d31a40d

SHA256
46402d100ef178dfd98fdece6285365ac4efc7609299e2a3dcccb1f90aee9240

SHA512
c95a25d34d117fbd0a27e99993041fe8e32f179f4c2bbc0eb3338c35a2f84fee82f7691e2a465695d9fb96a43cc84adaf0fadd07038507a0c4c1f7e7e7231850

Download Submit
\Windows\SysWOW64\etgeateas.exe

Filesize
68KB

MD5
c523a61dd1b6c85170a7a2628107c2f7

SHA1
850aa050b22a2dee70c9332e004d210ba4ade5ed

SHA256
06225b503b983c4a0619560dbab3c0ea0d71ffc92f52e3846e8e5cdca0850ea0

SHA512
5cf33c229bdea0aa29f063dfc25e89221e54e4263c53a9e70d7f69e656c9d882273e4037d4afd25bf4746d47f57f5179e376bebf70118292cdf369d78d7688b1

Download Submit
memory/2200-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2360-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2536-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download