Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe
-
Size
89KB
-
MD5
e3dfe4d509571e83a2168827b698e720
-
SHA1
07683550aaa05286e33f6acaab463f9dab690411
-
SHA256
3fdc38fba23ba9aa75cf72eb037253370b011b6cb768df692966fbb38fa1f44a
-
SHA512
88c875651016527a1bbda29de69c68773cbbd3cc93e70d0fec9d5fff29c957dd0466519816b9c68a4349a09e4b2ef5abda1240743343843932c282991a2e7023
-
SSDEEP
768:UOQJXKb6K4Fd6eUCRGIIPP1y7oLacaIBLP3ner42Q:UVJrTFTUCxQ1aZr42Q
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foanu.exe -
Executes dropped EXE 1 IoCs
pid Process 2544 foanu.exe -
Loads dropped DLL 2 IoCs
pid Process 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /y" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /e" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /h" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /x" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /s" e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /n" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /d" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /t" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /f" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /g" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /l" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /v" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /z" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /u" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /w" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /p" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /b" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /k" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /c" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /a" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /r" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /m" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /i" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /j" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /q" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /o" foanu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\foanu = "C:\\Users\\Admin\\foanu.exe /s" foanu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe 2544 foanu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 2544 foanu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2544 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2544 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2544 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 28 PID 2292 wrote to memory of 2544 2292 e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3dfe4d509571e83a2168827b698e720_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\foanu.exe"C:\Users\Admin\foanu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5a979c1ae90124b72969363773b722e87
SHA10e55195af866fad8c97e54254ef5c47da1dd8aa7
SHA25698a1f1f4c0730260b0756cfa3554aabc255e360d38095c399a629c7168e11c60
SHA512d439c087bb2828e7a04025126cbc648a9a1c3d175fcd86091980e7fc56fe351e7e4240c879d553122c1e16c387a5dbf73fa954d3a2c345e0354bf6ee704ba31e