Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe
-
Size
72KB
-
MD5
5fbf35ea147a76a86dc68d1b3313c0b0
-
SHA1
3f46c7c50640b08df868ee6f0929593374bba38b
-
SHA256
9ebd3b168cc538fb0c1bae2c1388e375b66c5bd54b0b108018719c7b6994455e
-
SHA512
c9a613e32099c81a6c158a481983aaf0a7b87e78d3c08e4edec612a3f6f9136fae6e7c5208bd838484e0d40696ec47d0f1a4f898a201d8d0cfd3341b9200209f
-
SSDEEP
1536:xJrcZa4V5fH01ZJdlUOIV3js6/XyMgjm6Ul0sYnLwDR:j6RRH0IVweitm7lXYnEDR
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ounbarooc-eaged.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c} ounbarooc-eaged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\IsInstalled = "1" ounbarooc-eaged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\StubPath = "C:\\Windows\\system32\\ouxtokeaf-idor.exe" ounbarooc-eaged.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\envusud.exe" ounbarooc-eaged.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ounbarooc-eaged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ounbarooc-eaged.exe -
Executes dropped EXE 2 IoCs
pid Process 1212 ounbarooc-eaged.exe 3484 ounbarooc-eaged.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ounbarooc-eaged.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ounbarooc-eaged.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ounbarooc-eaged.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ounbarooc-eaged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ounbarooc-eaged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\arxoopax.dll" ounbarooc-eaged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ounbarooc-eaged.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\arxoopax.dll ounbarooc-eaged.exe File opened for modification C:\Windows\SysWOW64\envusud.exe ounbarooc-eaged.exe File opened for modification C:\Windows\SysWOW64\arxoopax.dll ounbarooc-eaged.exe File created C:\Windows\SysWOW64\envusud.exe ounbarooc-eaged.exe File opened for modification C:\Windows\SysWOW64\ouxtokeaf-idor.exe ounbarooc-eaged.exe File created C:\Windows\SysWOW64\ouxtokeaf-idor.exe ounbarooc-eaged.exe File opened for modification C:\Windows\SysWOW64\ounbarooc-eaged.exe ounbarooc-eaged.exe File opened for modification C:\Windows\SysWOW64\ounbarooc-eaged.exe 5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ounbarooc-eaged.exe 5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 3484 ounbarooc-eaged.exe 3484 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe 1212 ounbarooc-eaged.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1212 ounbarooc-eaged.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1212 2040 5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe 85 PID 2040 wrote to memory of 1212 2040 5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe 85 PID 2040 wrote to memory of 1212 2040 5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe 85 PID 1212 wrote to memory of 3484 1212 ounbarooc-eaged.exe 86 PID 1212 wrote to memory of 3484 1212 ounbarooc-eaged.exe 86 PID 1212 wrote to memory of 3484 1212 ounbarooc-eaged.exe 86 PID 1212 wrote to memory of 612 1212 ounbarooc-eaged.exe 5 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56 PID 1212 wrote to memory of 3444 1212 ounbarooc-eaged.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5fbf35ea147a76a86dc68d1b3313c0b0_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\ounbarooc-eaged.exe"C:\Windows\SysWOW64\ounbarooc-eaged.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\ounbarooc-eaged.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD50cb76171ab9d9fd43ad255630d539037
SHA10ce17a5f9588d927a9ae331aaf60c704c8638ca1
SHA25669c831ec69d9e7af7cbf5c76881aca1be5462073e6709e9e92be501518cafad5
SHA5126565f756f7734757bb40d06010a67cde97b0104bf86b06fb9b94a9e07f88a4427d67e8fe7bd7afbeefe9670fdf5f51ef542ca6f6d44904ce1a8a0410eb8c91d6
-
Filesize
70KB
MD5b68e97780e3393aa5f34edbcfbf9e066
SHA104287e73ceb6937f877c85070e2d12b580a69fbf
SHA25647f239680117b418be15868450e3b79994fdc6ac8b0a062a5f7bf809eab9b595
SHA512f7d460753537f098a93dd52d67f0ff31a666004091243e2ad14942aa1310a546f45050a9137cc09ba8575baa99545a77d4e4731189a02c8f9d0c02c58b92c658
-
Filesize
72KB
MD5064c80827c6add3ad2e8c7f4e07cc377
SHA17568a1aef4f1919f7e38c71697b4637cb1cb2aca
SHA256b886c376bc7b394638ed6357501091ddf5457095d3063b8c159666b38b0e4775
SHA512b83efa403897a9b11f1fc4c73e441747176ccd5e5a2606e06af1d0ad492e2cb5ebb76bd1d184e994c50e8c3afd592fd161cfb738c01e0f2f4d743d7c4f787126