Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 14:06
Static task
static1
Behavioral task
behavioral1
Sample
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe
-
Size
116KB
-
MD5
d3c7fa2478979d3394778368daba38e0
-
SHA1
4793a20262c15d66b100370c67c916ebd9156fe3
-
SHA256
185044ca731c50e49bb3426bf62a81aefdbc6c4b20cf40dae2753725ba021dc4
-
SHA512
7f83d4c20f9741f04c31432897d199671c31a90a10b1e2ff8b0fe1031d3435570f9b0b6f70accc2337fdf5ca5f7562a1b02ff4f2ae8a69d58c1ac8b33bd11b00
-
SSDEEP
1536:JOH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5PxVw:JCKQJcinxphkG5Q6GdpIOkJHhKRfw
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/644-42-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/644-45-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/644-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/644-47-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/644-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 3228 Flaseher.exe 3968 Flaseher.exe 644 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/3884-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3884-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3884-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3884-53-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3968-55-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 4984 set thread context of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 3228 set thread context of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 set thread context of 644 3228 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe Token: SeDebugPrivilege 3968 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exed3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe 3228 Flaseher.exe 3968 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exed3c7fa2478979d3394778368daba38e0_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 4984 wrote to memory of 3884 4984 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe PID 3884 wrote to memory of 4804 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe cmd.exe PID 3884 wrote to memory of 4804 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe cmd.exe PID 3884 wrote to memory of 4804 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe cmd.exe PID 4804 wrote to memory of 1656 4804 cmd.exe reg.exe PID 4804 wrote to memory of 1656 4804 cmd.exe reg.exe PID 4804 wrote to memory of 1656 4804 cmd.exe reg.exe PID 3884 wrote to memory of 3228 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe Flaseher.exe PID 3884 wrote to memory of 3228 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe Flaseher.exe PID 3884 wrote to memory of 3228 3884 d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 3968 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe PID 3228 wrote to memory of 644 3228 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d3c7fa2478979d3394778368daba38e0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCHWX.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HCHWX.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
116KB
MD595614d3d3ebc6f95618bc955b24b5e1c
SHA100c49595f8cc0e2221bcf6f6080105a472140911
SHA256f82f94822b8fc1a1b053e3747d02dc7a0f61e9271e49f3a2ccf3062bb2ca808e
SHA5127f6f702422323eeb40f27245f72056bec09871881a540773edb25358ae07dbc9bbb3ed845cbf9a2ccae6a1f3cbf289e07e1fb23124cbc639d703ea0000b8f9fe
-
memory/644-51-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/644-47-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/644-49-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/644-45-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/644-42-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3228-48-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3228-37-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3228-38-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3884-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3884-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3884-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3884-53-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3968-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4984-8-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4984-7-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4984-4-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/4984-5-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/4984-2-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/4984-3-0x0000000002AA0000-0x0000000002AA1000-memory.dmpFilesize
4KB