Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 10:03
Static task
static1
Behavioral task
behavioral1
Sample
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe
-
Size
4.2MB
-
MD5
d9c74a3f56c783c73c35cc38c59c1b10
-
SHA1
67ab4e4f4d6187b375274201f0cb0aa4c4585744
-
SHA256
a42837e4007f5c67d2f0476ce85d56c9356c90d8e7fd24b874f51b0d8073c90b
-
SHA512
57df6fae1c6313838555ee1d465c018cf637b72cf59e75eaf8da85860eac6150645c4c235b31eeded78bf6f2cf871924fcb0cc649ffe820f8d76454db0cd94f6
-
SSDEEP
98304:ir5fFSzbkAtkKd7Zh8Uus6jHe96GrdYXKcZvTJMa5/E4Z:0FukAtpd7Zh8rpj+UGeDVtMajZ
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/4848-2-0x0000000003E40000-0x000000000472B000-memory.dmp family_glupteba behavioral2/memory/4848-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4848-4-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4848-24-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4848-27-0x0000000003E40000-0x000000000472B000-memory.dmp family_glupteba behavioral2/memory/4848-28-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4848-33-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4848-54-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4848-74-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4640-102-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4640-144-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-196-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-226-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-236-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-238-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-241-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-244-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-247-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba behavioral2/memory/4696-250-0x0000000000400000-0x0000000001DFB000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid Process 4256 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid Process 4696 csrss.exe 3940 injector.exe 1500 windefender.exe 468 windefender.exe -
Processes:
resource yara_rule behavioral2/files/0x000400000000070d-230.dat upx behavioral2/memory/1500-231-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1500-234-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/468-237-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/468-243-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.execsrss.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exedescription ioc Process File opened (read-only) \??\VBoxMiniRdrDN d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe -
Drops file in Windows directory 4 IoCs
Processes:
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.execsrss.exedescription ioc Process File created C:\Windows\rss\csrss.exe d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid Process 4952 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 976 powershell.exe 1088 powershell.exe 3872 powershell.exe 4060 powershell.exe 3772 powershell.exe 4296 powershell.exe 4252 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid Process 3872 schtasks.exe 3084 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exed9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exepowershell.exed9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid Process 1088 powershell.exe 1088 powershell.exe 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 3872 powershell.exe 3872 powershell.exe 3872 powershell.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 4060 powershell.exe 4060 powershell.exe 4060 powershell.exe 3772 powershell.exe 3772 powershell.exe 3772 powershell.exe 4296 powershell.exe 4296 powershell.exe 4296 powershell.exe 4252 powershell.exe 4252 powershell.exe 4252 powershell.exe 976 powershell.exe 976 powershell.exe 976 powershell.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 4696 csrss.exe 4696 csrss.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 4696 csrss.exe 4696 csrss.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 4696 csrss.exe 4696 csrss.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe 3940 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exed9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid Process Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Token: SeImpersonatePrivilege 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 4060 powershell.exe Token: SeDebugPrivilege 3772 powershell.exe Token: SeDebugPrivilege 4296 powershell.exe Token: SeDebugPrivilege 4252 powershell.exe Token: SeDebugPrivilege 976 powershell.exe Token: SeSystemEnvironmentPrivilege 4696 csrss.exe Token: SeSecurityPrivilege 4952 sc.exe Token: SeSecurityPrivilege 4952 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exed9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.execmd.execsrss.exewindefender.execmd.exedescription pid Process procid_target PID 4848 wrote to memory of 1088 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 93 PID 4848 wrote to memory of 1088 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 93 PID 4848 wrote to memory of 1088 4848 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 93 PID 4640 wrote to memory of 3872 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 105 PID 4640 wrote to memory of 3872 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 105 PID 4640 wrote to memory of 3872 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 105 PID 4640 wrote to memory of 2464 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 107 PID 4640 wrote to memory of 2464 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 107 PID 2464 wrote to memory of 4256 2464 cmd.exe 109 PID 2464 wrote to memory of 4256 2464 cmd.exe 109 PID 4640 wrote to memory of 4060 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 110 PID 4640 wrote to memory of 4060 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 110 PID 4640 wrote to memory of 4060 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 110 PID 4640 wrote to memory of 3772 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 112 PID 4640 wrote to memory of 3772 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 112 PID 4640 wrote to memory of 3772 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 112 PID 4640 wrote to memory of 4696 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 114 PID 4640 wrote to memory of 4696 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 114 PID 4640 wrote to memory of 4696 4640 d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe 114 PID 4696 wrote to memory of 4296 4696 csrss.exe 115 PID 4696 wrote to memory of 4296 4696 csrss.exe 115 PID 4696 wrote to memory of 4296 4696 csrss.exe 115 PID 4696 wrote to memory of 4252 4696 csrss.exe 119 PID 4696 wrote to memory of 4252 4696 csrss.exe 119 PID 4696 wrote to memory of 4252 4696 csrss.exe 119 PID 4696 wrote to memory of 976 4696 csrss.exe 123 PID 4696 wrote to memory of 976 4696 csrss.exe 123 PID 4696 wrote to memory of 976 4696 csrss.exe 123 PID 4696 wrote to memory of 3940 4696 csrss.exe 125 PID 4696 wrote to memory of 3940 4696 csrss.exe 125 PID 1500 wrote to memory of 4296 1500 windefender.exe 131 PID 1500 wrote to memory of 4296 1500 windefender.exe 131 PID 1500 wrote to memory of 4296 1500 windefender.exe 131 PID 4296 wrote to memory of 4952 4296 cmd.exe 132 PID 4296 wrote to memory of 4952 4296 cmd.exe 132 PID 4296 wrote to memory of 4952 4296 cmd.exe 132 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9c74a3f56c783c73c35cc38c59c1b10_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4256
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3872
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:964
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3084
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:4576
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51d41f4ca6589edd944a1731358fb5342
SHA13d9c56211cdb7e6701a68c49c9f29f7362b9454a
SHA25652eafa8c3f579fe2f261cd346d9e72aa79830271d107823a8c88d8df0cb7a5c4
SHA51218c520267d84833394f7cc46be38e49e8163539d2bb014c7dee85605a9ab988b2d06a5dc9bfbac6a2cf462a0c5a3728c932b2046e87f042f730abe5c79cb4439
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5186eed2cb7fa31f2de6ec399af0630f6
SHA1dc0404fa2949202f4fd92328bf34df96223bcfa4
SHA2567f03ee8d14bf0c63c7ccf44d8bb4ba9096d311fe24542640a45e98b17f8e5768
SHA5127350d20ddc422ce3af57848dd3785031880d36f946959bb7399c87bc6aad474469a66b2bd06c3f394fff97b05b68ad298a0b6736b661f5c5de64e576c7801986
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f493c5c5fd1e25cdf9319b2bae816502
SHA19bb40262ffa714a916504797e0b6ff0a2c64d4e7
SHA2563e9634485eb519a44b6e6f43e4f4f60356cfaa1f773cc943ecdae0535ec414ae
SHA5126ce20f261d94ee36cd6b49017080883499aa96ae592787ceb5edd061c7f7a56a0d029af8c94acb443e55d7dab656b854209d4da140b27c7734479cf09d7cffd9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a15333108b7212fa14e502d3ac86a028
SHA10be98e9175c708ff58253dfe122e4b0f302051b5
SHA256abdd8cbfcc85ad876b9f68c6d39dc7528aeaf8ebc1c2bf4a99ab8389970b85ca
SHA5124c30e43b102f59310c7a101c7a92bc0e8cf9ff8747c6b2b32c18371000eb972b74bf17f91b9c482e0262380922852e0fc0472693143dc7af39c5846b69e952da
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a282d42918bd65ee4f4fdc6529b6939d
SHA1d56bd3a8019eea08844f6d53d474a38371e556be
SHA2560c671afb934e1e0a31146a460404f8b1c3bc634155d296c48de2d458f0401893
SHA512ee3659d3691761cbdd105e3d318e7db483cddbbd15ab14f69789b81dc348c72c4be9da7f240338fe4ed7ffa6c26238c410dd0b315404962716208cc14deee925
-
Filesize
4.2MB
MD5d9c74a3f56c783c73c35cc38c59c1b10
SHA167ab4e4f4d6187b375274201f0cb0aa4c4585744
SHA256a42837e4007f5c67d2f0476ce85d56c9356c90d8e7fd24b874f51b0d8073c90b
SHA51257df6fae1c6313838555ee1d465c018cf637b72cf59e75eaf8da85860eac6150645c4c235b31eeded78bf6f2cf871924fcb0cc649ffe820f8d76454db0cd94f6
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec