8d898cb882820bf073e475e86d693fbc2ba33645a1b02fa12d606005e7e09d24

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
Size

73KB
MD5

83218599358597d4b0637a32726630c0
SHA1

0924f94e6b2fe183b58044077047ff12157cfa42
SHA256

8d898cb882820bf073e475e86d693fbc2ba33645a1b02fa12d606005e7e09d24
SHA512

d74b8aa3b4a534f644c3ea114a3b18860fbc8819202ec16b3cdea085b6a659648808442bc2f12a70f496820c28d9019c68fb1578a6c956f8c3a3759ed41416dd
SSDEEP

768:x/nlrF9TAbYmFr1BndWdhKjJFJLLeTYSOmPPxfXjGca8Iaxqm4Ts9s5qCfRpXMRJ:x5FNAlTnd+5rO0PxfXZVBZq5qYXMEs

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	avbafit.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1"	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\ubpupooc.exe"	avbafit.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\dpoabeab.exe"	avbafit.exe

Executes dropped EXE 2 IoCs

pid	Process
2792	avbafit.exe
2948	avbafit.exe

Loads dropped DLL 3 IoCs

pid	Process
2264	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
2264	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
2792	avbafit.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	avbafit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	avbafit.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	avbafit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\odtaroas-eavur.dll"	avbafit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	avbafit.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\avbafit.exe	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\dpoabeab.exe	avbafit.exe
File created	C:\Windows\SysWOW64\dpoabeab.exe	avbafit.exe
File opened for modification	C:\Windows\SysWOW64\odtaroas-eavur.dll	avbafit.exe
File created	C:\Windows\SysWOW64\odtaroas-eavur.dll	avbafit.exe
File opened for modification	C:\Windows\SysWOW64\avbafit.exe	avbafit.exe
File created	C:\Windows\SysWOW64\avbafit.exe	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ubpupooc.exe	avbafit.exe
File created	C:\Windows\SysWOW64\ubpupooc.exe	avbafit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2948	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe
2792	avbafit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	avbafit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2792	2264	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	28
PID 2264 wrote to memory of 2792	2264	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	28
PID 2264 wrote to memory of 2792	2264	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	28
PID 2264 wrote to memory of 2792	2264	83218599358597d4b0637a32726630c0_NeikiAnalytics.exe	28
PID 2792 wrote to memory of 436	2792	avbafit.exe	5
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 2948	2792	avbafit.exe	29
PID 2792 wrote to memory of 2948	2792	avbafit.exe	29
PID 2792 wrote to memory of 2948	2792	avbafit.exe	29
PID 2792 wrote to memory of 2948	2792	avbafit.exe	29
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21
PID 2792 wrote to memory of 1216	2792	avbafit.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\83218599358597d4b0637a32726630c0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\83218599358597d4b0637a32726630c0_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\avbafit.exe
    "C:\Windows\SysWOW64\avbafit.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\avbafit.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dpoabeab.exe

Filesize
74KB

MD5
0286c1b274ffa1a5dfca706d83b0fa25

SHA1
52c1947904e2d7096b1aff9d8eb017479a2d52a1

SHA256
a6431b3f116af82fbd57afea53086ffdba2d271f2d321fe70e9593a7da4304a9

SHA512
7654cb050ae61859ae932f30a9116ed12d7dbee0e70b7a39dc558ad97149418a9bb56058cd5f937a96689eb342b36a1b976ffeb62f269d8ac8332412667f46cb

Download Submit
C:\Windows\SysWOW64\odtaroas-eavur.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ubpupooc.exe

Filesize
73KB

MD5
064a303cd7c957b1ebf6cbf0d749dbac

SHA1
0450a12762684d701a01899ce6974ea04016369d

SHA256
0347009b19746d787ef278156d6ac3343cebbe4f99d47a0a837713db01ac0518

SHA512
55daef9de11eed113c7b01ced2aaf4ce5ae337af67f262c18ca195804ceb7b468ed4d85fc2b6bcbb38a7167c8a1c74371cd53fe6354c9272136dae5a365c4f70

Download Submit
\Windows\SysWOW64\avbafit.exe

Filesize
70KB

MD5
bacde6595add770736ca8f6689627fae

SHA1
9a7c13eb936c5216624c3e4be94659742ca360eb

SHA256
861b3f36c682124f523fcbce2fd509b458885946034db64788f2f5599dea837e

SHA512
b0725c3590bc4e99f595e4160e026a33c9e9e21a76d55e761c38c7560d137024bd3efdef5bf8bad99275a165ef44bdd00e73c8b042bbb67b2d18664efeb3554f

Download Submit
memory/2264-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2792-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2948-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download