Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe
-
Size
596KB
-
MD5
1d3535cc01b2cc54b808a55e945707a0
-
SHA1
a9a563b8ee37f17c847248bb207b28086d9f4628
-
SHA256
f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19
-
SHA512
4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc
-
SSDEEP
12288:15/Sm4/r42toIX4IaZo2BOtdMKX8MbICwAvV6LwfAnxMlpxxWmBNIg9SWvAK:70/rX8IJ2BwNQcfAnxgDzBx
Malware Config
Extracted
redline
Vic
beshomandotestbesnd.run.place:1111
Extracted
xworm
127.0.0.1:7000
beshomandotestbesnd.run.place:7000
-
Install_directory
%ProgramData%
-
install_file
taskmgr.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Signatures
-
Detect Xworm Payload 5 IoCs
Processes:
resource yara_rule C:\ProgramData\system.exe family_xworm behavioral1/memory/2668-137-0x0000000001110000-0x000000000112A000-memory.dmp family_xworm behavioral1/memory/2844-138-0x0000000000940000-0x0000000000980000-memory.dmp family_xworm behavioral1/memory/1100-366-0x0000000000A20000-0x0000000000A3A000-memory.dmp family_xworm behavioral1/memory/2820-369-0x0000000000BF0000-0x0000000000C0A000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2844-134-0x00000000008A0000-0x00000000008BE000-memory.dmp family_redline C:\ProgramData\build.exe family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2844-134-0x00000000008A0000-0x00000000008BE000-memory.dmp family_sectoprat C:\ProgramData\build.exe family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2308 powershell.exe 2812 powershell.exe 1504 powershell.exe 1800 powershell.exe -
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/2372-5-0x0000000004740000-0x00000000047A6000-memory.dmp net_reactor behavioral1/memory/2372-6-0x00000000047B0000-0x0000000004814000-memory.dmp net_reactor behavioral1/memory/2372-7-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-22-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-8-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-10-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-12-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-14-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-16-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-18-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-69-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-34-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-70-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-66-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-64-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-62-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-60-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-58-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-56-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-54-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-53-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-50-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-48-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-47-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-44-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-42-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-40-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-38-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-36-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-32-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-30-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-28-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-26-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-24-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor behavioral1/memory/2372-20-0x00000000047B0000-0x000000000480F000-memory.dmp net_reactor -
Drops startup file 2 IoCs
Processes:
system.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.lnk system.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.lnk system.exe -
Executes dropped EXE 4 IoCs
Processes:
system.exebuild.exetaskmgr.exetaskmgr.exepid process 2668 system.exe 2844 build.exe 1100 taskmgr.exe 2820 taskmgr.exe -
Loads dropped DLL 2 IoCs
Processes:
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exepid process 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
system.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskmgr = "C:\\ProgramData\\taskmgr.exe" system.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
build.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 build.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 build.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
system.exepid process 2668 system.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesystem.exebuild.exepid process 2308 powershell.exe 2812 powershell.exe 1504 powershell.exe 1800 powershell.exe 2668 system.exe 2844 build.exe 2844 build.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exesystem.exebuild.exepowershell.exepowershell.exepowershell.exepowershell.exetaskmgr.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe Token: SeDebugPrivilege 2668 system.exe Token: SeDebugPrivilege 2844 build.exe Token: SeDebugPrivilege 2308 powershell.exe Token: SeDebugPrivilege 2812 powershell.exe Token: SeDebugPrivilege 1504 powershell.exe Token: SeDebugPrivilege 1800 powershell.exe Token: SeDebugPrivilege 2668 system.exe Token: SeDebugPrivilege 1100 taskmgr.exe Token: SeDebugPrivilege 2820 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
system.exepid process 2668 system.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exesystem.exetaskeng.exedescription pid process target process PID 2372 wrote to memory of 2668 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2372 wrote to memory of 2668 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2372 wrote to memory of 2668 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2372 wrote to memory of 2668 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe system.exe PID 2372 wrote to memory of 2844 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2372 wrote to memory of 2844 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2372 wrote to memory of 2844 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2372 wrote to memory of 2844 2372 1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe build.exe PID 2668 wrote to memory of 2308 2668 system.exe powershell.exe PID 2668 wrote to memory of 2308 2668 system.exe powershell.exe PID 2668 wrote to memory of 2308 2668 system.exe powershell.exe PID 2668 wrote to memory of 2812 2668 system.exe powershell.exe PID 2668 wrote to memory of 2812 2668 system.exe powershell.exe PID 2668 wrote to memory of 2812 2668 system.exe powershell.exe PID 2668 wrote to memory of 1504 2668 system.exe powershell.exe PID 2668 wrote to memory of 1504 2668 system.exe powershell.exe PID 2668 wrote to memory of 1504 2668 system.exe powershell.exe PID 2668 wrote to memory of 1800 2668 system.exe powershell.exe PID 2668 wrote to memory of 1800 2668 system.exe powershell.exe PID 2668 wrote to memory of 1800 2668 system.exe powershell.exe PID 2668 wrote to memory of 1612 2668 system.exe schtasks.exe PID 2668 wrote to memory of 1612 2668 system.exe schtasks.exe PID 2668 wrote to memory of 1612 2668 system.exe schtasks.exe PID 996 wrote to memory of 1100 996 taskeng.exe taskmgr.exe PID 996 wrote to memory of 1100 996 taskeng.exe taskmgr.exe PID 996 wrote to memory of 1100 996 taskeng.exe taskmgr.exe PID 996 wrote to memory of 2820 996 taskeng.exe taskmgr.exe PID 996 wrote to memory of 2820 996 taskeng.exe taskmgr.exe PID 996 wrote to memory of 2820 996 taskeng.exe taskmgr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d3535cc01b2cc54b808a55e945707a0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\system.exe"C:\ProgramData\system.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"3⤵
- Creates scheduled task(s)
-
C:\ProgramData\build.exe"C:\ProgramData\build.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {F422B2BE-E646-4404-A175-A2C2DC948F9C} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\taskmgr.exeC:\ProgramData\taskmgr.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\taskmgr.exeC:\ProgramData\taskmgr.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\build.exeFilesize
95KB
MD516280875fdcf55ab4c8f1dff6dabc72e
SHA139880e6fbb258f4f4fa5c79337ec893acae55fb7
SHA25691455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a
SHA51253ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e
-
C:\ProgramData\system.exeFilesize
75KB
MD570b9f8ef4c4ce24fe372b292aebcd138
SHA15fd7ce9318727b27db0dd50effbb632686d53f8c
SHA25615af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b
SHA512b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Cab47FA.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar491A.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp4C03.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp4C38.tmpFilesize
92KB
MD5c38ea50a9d1b652272fdae5db82c9404
SHA1d7444179c921d090b4e5d954997087bc0004e69f
SHA256b5e3708f123a02f980e4e8397a055b98dceecdc754bbb67872e8bf3651541742
SHA512b91d23e89ca310a4cc9bbfc9537880e1b0c09d0ebf28fa1514258110f3fe33493f24145430093c9d1eb6ddcac8ef25ed74eb0d0c2c8c0544c1cfe2dcf206e2f5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD59734a2baf69a3d63dfcc7f5a066824b6
SHA14f24a41f54f6cacd7a4dcc2232444668d95b6391
SHA256221b4b434a00137b435ef1f577e6c0b0614db88abdd7ef84eee99b0754600e75
SHA512efc869aa6016176442760ee412c52e354ce72415e077442b7a9bab4a124c63a5a9ea7bc8f1a8d2277e69d431359eee2a25f1706714e8e27e0f74854d181b366d
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1100-366-0x0000000000A20000-0x0000000000A3A000-memory.dmpFilesize
104KB
-
memory/2308-145-0x0000000002770000-0x0000000002778000-memory.dmpFilesize
32KB
-
memory/2308-144-0x000000001B660000-0x000000001B942000-memory.dmpFilesize
2.9MB
-
memory/2372-36-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-130-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2372-69-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-34-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-70-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-66-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-64-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-62-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-60-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-58-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-56-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-54-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-53-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-50-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-48-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-47-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-44-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-42-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-40-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-38-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-1-0x0000000000600000-0x0000000000700000-memory.dmpFilesize
1024KB
-
memory/2372-32-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-30-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-28-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-26-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-24-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-20-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-18-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-3-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/2372-2-0x0000000000220000-0x00000000002A8000-memory.dmpFilesize
544KB
-
memory/2372-133-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/2372-16-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-131-0x0000000000600000-0x0000000000700000-memory.dmpFilesize
1024KB
-
memory/2372-4-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/2372-14-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-5-0x0000000004740000-0x00000000047A6000-memory.dmpFilesize
408KB
-
memory/2372-6-0x00000000047B0000-0x0000000004814000-memory.dmpFilesize
400KB
-
memory/2372-7-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-12-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-10-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-8-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2372-22-0x00000000047B0000-0x000000000480F000-memory.dmpFilesize
380KB
-
memory/2668-360-0x000007FEF5933000-0x000007FEF5934000-memory.dmpFilesize
4KB
-
memory/2668-139-0x0000000000450000-0x00000000004D0000-memory.dmpFilesize
512KB
-
memory/2668-137-0x0000000001110000-0x000000000112A000-memory.dmpFilesize
104KB
-
memory/2668-136-0x000007FEF5933000-0x000007FEF5934000-memory.dmpFilesize
4KB
-
memory/2668-362-0x0000000000450000-0x00000000004D0000-memory.dmpFilesize
512KB
-
memory/2812-152-0x0000000002820000-0x0000000002828000-memory.dmpFilesize
32KB
-
memory/2812-151-0x000000001B710000-0x000000001B9F2000-memory.dmpFilesize
2.9MB
-
memory/2820-369-0x0000000000BF0000-0x0000000000C0A000-memory.dmpFilesize
104KB
-
memory/2844-134-0x00000000008A0000-0x00000000008BE000-memory.dmpFilesize
120KB
-
memory/2844-361-0x0000000000940000-0x0000000000980000-memory.dmpFilesize
256KB
-
memory/2844-359-0x00000000742AE000-0x00000000742AF000-memory.dmpFilesize
4KB
-
memory/2844-135-0x00000000742AE000-0x00000000742AF000-memory.dmpFilesize
4KB
-
memory/2844-138-0x0000000000940000-0x0000000000980000-memory.dmpFilesize
256KB