Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 05:00
Behavioral task
behavioral1
Sample
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe
-
Size
72KB
-
MD5
9f367f475bd6bed5bc886e6d578d5130
-
SHA1
3dd5c8c54019b93368f19cce69d04a3e51910a01
-
SHA256
fe97fe4468d5eefa6f5b3df6a6ec4d9d3949b1929a4855801b071f8e3f0519ee
-
SHA512
1faccc1d663e1eadb8427099cbaeafd7fde29c9f730aa635a336a229f97446aaa4a9330a947786b16cf8f3f482b065c0052600b353b5ef7315a44b5fcd77a899
-
SSDEEP
1536:DOa2kZ+qcAGVRIcUjmTeyovQe1RLP0sLJtoz9ZDu7GOXTm:DOYZTBORVUjtvR1L96BSXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4784-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4784-47-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4784-55-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4784-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4784-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4784-61-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 2320 Flaseher.exe 4052 Flaseher.exe 4784 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/2988-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4228-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4228-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2988-13-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4228-12-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/2320-36-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2320-40-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2320-41-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2320-54-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4052-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2320-45-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4228-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4052-60-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 2988 set thread context of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2320 set thread context of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 set thread context of 4784 2320 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe Token: SeDebugPrivilege 4052 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 2320 Flaseher.exe 4052 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 2988 wrote to memory of 4228 2988 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe PID 4228 wrote to memory of 4128 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe cmd.exe PID 4228 wrote to memory of 4128 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe cmd.exe PID 4228 wrote to memory of 4128 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe cmd.exe PID 4128 wrote to memory of 2396 4128 cmd.exe reg.exe PID 4128 wrote to memory of 2396 4128 cmd.exe reg.exe PID 4128 wrote to memory of 2396 4128 cmd.exe reg.exe PID 4228 wrote to memory of 2320 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe Flaseher.exe PID 4228 wrote to memory of 2320 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe Flaseher.exe PID 4228 wrote to memory of 2320 4228 9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4052 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe PID 2320 wrote to memory of 4784 2320 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f367f475bd6bed5bc886e6d578d5130_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\APQNW.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\APQNW.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
72KB
MD515b6bcdc511c9be0cff13df34e21b39a
SHA16a426ab1b93202349da0569da6e64c22a6dcc217
SHA256d9ea7e8a5667f68f64905dc6bae1dd7d0b683761efc1cf6ccb5182f0d2868b6d
SHA512129e89a1802dcb40ab60c90d6cdb300dfcb8c57a997b691930beec071074eea0fa583bc1ba2d6ad191d5d66f2bc8ea68aa8bd4436d4045ff3bb7ce43b36a1bdd
-
memory/2320-54-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2320-36-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2320-40-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2320-45-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2320-41-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2988-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/2988-13-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2988-8-0x0000000002B70000-0x0000000002B71000-memory.dmpFilesize
4KB
-
memory/2988-0-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2988-3-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/2988-4-0x0000000002AE0000-0x0000000002AE1000-memory.dmpFilesize
4KB
-
memory/2988-6-0x0000000002B20000-0x0000000002B21000-memory.dmpFilesize
4KB
-
memory/2988-5-0x0000000002AF0000-0x0000000002AF1000-memory.dmpFilesize
4KB
-
memory/4052-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4052-60-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4228-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4228-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4228-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4228-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4784-47-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4784-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4784-49-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4784-58-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4784-59-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4784-61-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB