8c660815f34f2cdb08da1aad0c95b27f6288e8cc58d27067b5209998f7556292

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
Size

70KB
MD5

5579273ec1bb0bbdb06aeeffb1899f30
SHA1

ec527c45d2b3ddac3586a417cb6ad53f09b574e9
SHA256

8c660815f34f2cdb08da1aad0c95b27f6288e8cc58d27067b5209998f7556292
SHA512

0a04fc2684a3c2d0ec06ff50ae68f3830865bd1117d0854fad0c72c2372a1b8a82abd578c7090ebab532e6d6b912a3be475e57f40f6b235b0e550ca2e7886787
SSDEEP

1536:x+Yh85gHOEutUKZKEHfmWqk0AEPGER3ZajZ0b:fh3HOEuaWKE+/RA87R64

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	etgeateas.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}\IsInstalled = "1"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}\StubPath = "C:\\Windows\\system32\\adsukat.exe"	etgeateas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	etgeateas.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ovdarav.exe"	etgeateas.exe

Executes dropped EXE 2 IoCs

pid	Process
4764	etgeateas.exe
924	etgeateas.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	etgeateas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	etgeateas.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	etgeateas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eacxoohes-kur.dll"	etgeateas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	etgeateas.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\etgeateas.exe	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ovdarav.exe	etgeateas.exe
File opened for modification	C:\Windows\SysWOW64\etgeateas.exe	etgeateas.exe
File opened for modification	C:\Windows\SysWOW64\etgeateas.exe	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\adsukat.exe	etgeateas.exe
File created	C:\Windows\SysWOW64\adsukat.exe	etgeateas.exe
File opened for modification	C:\Windows\SysWOW64\eacxoohes-kur.dll	etgeateas.exe
File created	C:\Windows\SysWOW64\eacxoohes-kur.dll	etgeateas.exe
File created	C:\Windows\SysWOW64\ovdarav.exe	etgeateas.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
924	etgeateas.exe
924	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe
4764	etgeateas.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	etgeateas.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4764	1984	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	82
PID 1984 wrote to memory of 4764	1984	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	82
PID 1984 wrote to memory of 4764	1984	5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe	82
PID 4764 wrote to memory of 616	4764	etgeateas.exe	5
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 924	4764	etgeateas.exe	83
PID 4764 wrote to memory of 924	4764	etgeateas.exe	83
PID 4764 wrote to memory of 924	4764	etgeateas.exe	83
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56
PID 4764 wrote to memory of 3548	4764	etgeateas.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3548
- C:\Users\Admin\AppData\Local\Temp\5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\5579273ec1bb0bbdb06aeeffb1899f30_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\etgeateas.exe
    "C:\Windows\SysWOW64\etgeateas.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\etgeateas.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\adsukat.exe

Filesize
70KB

MD5
50d1609066a39ad1d3656d7e8b15cb4a

SHA1
5b010907c0147d52a594868b63828811c4c68b10

SHA256
e023210c10c61112b154e492a7ae3b37ab021a1f703847a9a62f78c2e747034b

SHA512
c02ba977ca529de9e6af16a56ed480652366f0e4951f1db44d8edfb66834bbb1888c8f027b3ce568eb1bdee8714841371014762c504ea5942a84ba47c32bae3f

Download Submit
C:\Windows\SysWOW64\eacxoohes-kur.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\etgeateas.exe

Filesize
68KB

MD5
c523a61dd1b6c85170a7a2628107c2f7

SHA1
850aa050b22a2dee70c9332e004d210ba4ade5ed

SHA256
06225b503b983c4a0619560dbab3c0ea0d71ffc92f52e3846e8e5cdca0850ea0

SHA512
5cf33c229bdea0aa29f063dfc25e89221e54e4263c53a9e70d7f69e656c9d882273e4037d4afd25bf4746d47f57f5179e376bebf70118292cdf369d78d7688b1

Download Submit
C:\Windows\SysWOW64\ovdarav.exe

Filesize
71KB

MD5
f967eac543f9ab15d1579c09fcf80c7a

SHA1
c4fe2ba132822545e9a6839552fa3a2c928fd19c

SHA256
c346c8b92364231e138a1ed776d2dacb4e9dcf85169a902215da97a9684a3194

SHA512
3f310190e8a20eb3e86a67fdc9930089637682ce76787be3f75e54c84891fb59803383768e83eba607e781871e2cc92d0ae8c496b0d393b3dd8de04a35147245

Download Submit
memory/924-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1984-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4764-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download