c99bc393b31f9cd2a5fcb6a30429ae488fb9982d8309788e19badbe8ad79e268

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe
Size

71KB
MD5

eae1059b009491988b5db1c8ebea0db0
SHA1

43db70c30168b0b7a7fe0cff290282348fff9c22
SHA256

c99bc393b31f9cd2a5fcb6a30429ae488fb9982d8309788e19badbe8ad79e268
SHA512

8221098d3eff7db91cfc241ab4044d5c3e212cbfac9f4489ce4032530bc42ff6fd9df3daa0c003cb510f3db75968f5be405a7eccbdb93348d473fddd9ab083c9
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slp:Olg35GTslA5t3/w8e

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	updoofuh.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\arfeaxoar-doab.exe"	updoofuh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}	updoofuh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1"	updoofuh.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	updoofuh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ibharak-ucor.exe"	updoofuh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	updoofuh.exe

Executes dropped EXE 2 IoCs

pid	Process
3964	updoofuh.exe
2752	updoofuh.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	updoofuh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	updoofuh.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	updoofuh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	updoofuh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	updoofuh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	updoofuh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\outxoapib.dll"	updoofuh.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\outxoapib.dll	updoofuh.exe
File created	C:\Windows\SysWOW64\ibharak-ucor.exe	updoofuh.exe
File opened for modification	C:\Windows\SysWOW64\arfeaxoar-doab.exe	updoofuh.exe
File created	C:\Windows\SysWOW64\arfeaxoar-doab.exe	updoofuh.exe
File created	C:\Windows\SysWOW64\outxoapib.dll	updoofuh.exe
File opened for modification	C:\Windows\SysWOW64\updoofuh.exe	updoofuh.exe
File opened for modification	C:\Windows\SysWOW64\updoofuh.exe	eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\updoofuh.exe	eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ibharak-ucor.exe	updoofuh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
2752	updoofuh.exe
2752	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe
3964	updoofuh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3964	updoofuh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3964	4548	eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe	82
PID 4548 wrote to memory of 3964	4548	eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe	82
PID 4548 wrote to memory of 3964	4548	eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe	82
PID 3964 wrote to memory of 636	3964	updoofuh.exe	5
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 2752	3964	updoofuh.exe	83
PID 3964 wrote to memory of 2752	3964	updoofuh.exe	83
PID 3964 wrote to memory of 2752	3964	updoofuh.exe	83
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55
PID 3964 wrote to memory of 3384	3964	updoofuh.exe	55

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3384
- C:\Users\Admin\AppData\Local\Temp\eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\eae1059b009491988b5db1c8ebea0db0_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\updoofuh.exe
    "C:\Windows\system32\updoofuh.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\SysWOW64\updoofuh.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\arfeaxoar-doab.exe

Filesize
73KB

MD5
f6e9dc0cb2f038a952f8453668b2fb3c

SHA1
06505906726a9d6862105d532d6a326312852fda

SHA256
ac93dec6b0d00190da994c606e671da3efd5f93c820de4c5a741d08a7d792327

SHA512
e684eb4b15f7cbbcd13fbd5b12202465de51a2b9cfaf60a5d6a91f05755f6c80ad4f3086c05b761d6a21363d273962057b92cea1cbfd56ad3d793af2a3e4ee16

Download Submit
C:\Windows\SysWOW64\ibharak-ucor.exe

Filesize
74KB

MD5
f31f92c11d3ccf9043a80f5031232be7

SHA1
5cc88e12754ac507cf7b1a3981cc65041903deb2

SHA256
d39f0cc1564117b667c32d8924b412eae2dd3c7a8685fe095b1880e79d9228e1

SHA512
2262505eb291543e5a4c63fafd6271ea8e47a9adf08690b262c8ca6b43af8508e02667b0864aa7af3df4753361fd90c77159d1ecfe374c2f24bcb032e4633107

Download Submit
C:\Windows\SysWOW64\outxoapib.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\updoofuh.exe

Filesize
71KB

MD5
eae1059b009491988b5db1c8ebea0db0

SHA1
43db70c30168b0b7a7fe0cff290282348fff9c22

SHA256
c99bc393b31f9cd2a5fcb6a30429ae488fb9982d8309788e19badbe8ad79e268

SHA512
8221098d3eff7db91cfc241ab4044d5c3e212cbfac9f4489ce4032530bc42ff6fd9df3daa0c003cb510f3db75968f5be405a7eccbdb93348d473fddd9ab083c9

Download Submit
memory/2752-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3964-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4548-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download