Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 11:09
Behavioral task
behavioral1
Sample
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe
-
Size
130KB
-
MD5
dc07870c7f9f4dd2bcc0ed9f43a4b960
-
SHA1
2bacdc1f8a31fc38a155395d63e60248d71477ff
-
SHA256
4aa052a52066e9241f7cded0952bafa7b531276d3b2a0feb0c175d59f69d29b6
-
SHA512
c3a721808741e7965c5122196c871e9f4aee14f144e6a70c74fa6ba3f5bef163aa11ee89de6202fb98e939bf27f140cff884ab3df23413574601acdb1c69490c
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZO:SKQJcinxphkG5Q6GdpIOkJHhKRyOXKk
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1996-47-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1996-50-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1996-44-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1996-52-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1996-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/1996-58-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 4980 Flaseher.exe 4488 Flaseher.exe 1996 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/1048-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2976-5-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2976-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2976-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1048-11-0x0000000000400000-0x0000000000423000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/4980-35-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4980-38-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4980-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4980-43-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4980-53-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2976-55-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4488-57-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 1048 set thread context of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 4980 set thread context of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 set thread context of 1996 4980 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe Token: SeDebugPrivilege 4488 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exedc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe 4980 Flaseher.exe 4488 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exedc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 1048 wrote to memory of 2976 1048 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe PID 2976 wrote to memory of 3416 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe cmd.exe PID 2976 wrote to memory of 3416 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe cmd.exe PID 2976 wrote to memory of 3416 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe cmd.exe PID 3416 wrote to memory of 4620 3416 cmd.exe reg.exe PID 3416 wrote to memory of 4620 3416 cmd.exe reg.exe PID 3416 wrote to memory of 4620 3416 cmd.exe reg.exe PID 2976 wrote to memory of 4980 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe Flaseher.exe PID 2976 wrote to memory of 4980 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe Flaseher.exe PID 2976 wrote to memory of 4980 2976 dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 4488 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe PID 4980 wrote to memory of 1996 4980 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dc07870c7f9f4dd2bcc0ed9f43a4b960_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JOACF.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\JOACF.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD5389b5c7a704d65b500584928cbac0ed3
SHA18004932f5cec49ffbed4984e27fbde2eeb484cbe
SHA25628d646079a805dc18019039f304c370a5ba6866cb721cf586d465bf78b48e93c
SHA5126cc031cf9ae08467f7477a390a65dd14cc17b39d06e87129a241bb328f029d267ea0d75c47d60c7674b5fd082aed07294bbe339ea6e70eadf893c0dd3ae71ee9
-
memory/1048-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1048-8-0x0000000002B70000-0x0000000002B71000-memory.dmpFilesize
4KB
-
memory/1048-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/1048-11-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1048-3-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/1048-4-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/1996-58-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1996-54-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1996-47-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1996-52-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1996-44-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1996-50-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2976-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2976-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2976-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2976-5-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4488-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4980-43-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4980-39-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4980-38-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4980-35-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4980-53-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB