Analysis

  • max time kernel
    8s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 00:59

General

  • Target

    3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe

  • Size

    732KB

  • MD5

    3b94744c1af3863468425acb2d086870

  • SHA1

    e8e04d433b325e7c6f7375ed90eb6f44bddb4a50

  • SHA256

    7286faa87d9761ae37f4cd3122865b829f2cab42eff87a3ffba01047929e508a

  • SHA512

    bf12103aa593d6a4d5fa8325c22f26487b718865c278dc1a740780490c6ac1438db082bfbfcf1847be18c449076c4cc3db7c1289a2104f84863cac348ca639e7

  • SSDEEP

    12288:ITyjXW+48qWywrU4kGFezOAVuJ5PIqww7F5DO3HYff8vt8nF:GIXW/8yw1ez54lIUF5SXYH0+nF

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1068
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1076
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1172
          • C:\Users\Admin\AppData\Local\Temp\3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe"
            2⤵
            • Modifies firewall policy service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2168
            • C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
              3⤵
              • Modifies firewall policy service
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2984
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1544

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\0F763534_Rar\rundll32.exe

            Filesize

            664KB

            MD5

            2eb5d76180ce7b3241b281fa79ab3483

            SHA1

            06293dea80e39c7eb7ee2bdb00d60b58d932fa8a

            SHA256

            e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8

            SHA512

            35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b

          • C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

            Filesize

            732KB

            MD5

            3b94744c1af3863468425acb2d086870

            SHA1

            e8e04d433b325e7c6f7375ed90eb6f44bddb4a50

            SHA256

            7286faa87d9761ae37f4cd3122865b829f2cab42eff87a3ffba01047929e508a

            SHA512

            bf12103aa593d6a4d5fa8325c22f26487b718865c278dc1a740780490c6ac1438db082bfbfcf1847be18c449076c4cc3db7c1289a2104f84863cac348ca639e7

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            8b6d3d50e32f3ce4a40c520fb4c11e06

            SHA1

            6a00b3147e1c61f7e2bc80158e73a8d2b2033aca

            SHA256

            94f42d2b22181d604a0df80cd7bb4df65e9e2dcf1e1e5d6750eae40f98174fa7

            SHA512

            16c2d90c5bc2eec1341caeadf8fd25e36b536cf8997278ff33ef436c4be42496b914d52b48b5156f2c1f5e9c4998eeba6212f977c907d0989059066ec0a4559d

          • C:\egmpao.pif

            Filesize

            97KB

            MD5

            af3ca52f822347031a36df4f8a91186b

            SHA1

            f1c48e09eb359805914cfd27ee737be99fd7ace0

            SHA256

            d84a95636c92ca8a43216902fb224f5c3885e14c8545b62aeddc06ceb112d2f3

            SHA512

            45ea76645141437e5a221b4aa05bd36350247c83bfc15d8f8cfda3f34edd7d781a620579927d45df696f57256ffaee94fcc864c5208daa8486212ab33c7f707a

          • memory/1068-21-0x0000000000390000-0x0000000000392000-memory.dmp

            Filesize

            8KB

          • memory/2168-13-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-15-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-33-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2168-32-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2168-30-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2168-29-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2168-14-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-12-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-11-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-10-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-8-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-34-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2168-38-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-37-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-7-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-43-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-9-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-0-0x0000000000400000-0x00000000004BF000-memory.dmp

            Filesize

            764KB

          • memory/2168-5-0x00000000024D0000-0x000000000358A000-memory.dmp

            Filesize

            16.7MB

          • memory/2168-58-0x0000000008DF0000-0x0000000008EAF000-memory.dmp

            Filesize

            764KB

          • memory/2168-60-0x0000000000400000-0x00000000004BF000-memory.dmp

            Filesize

            764KB

          • memory/2984-89-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2984-63-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-65-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-61-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-67-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-59-0x0000000000400000-0x00000000004BF000-memory.dmp

            Filesize

            764KB

          • memory/2984-68-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-66-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-64-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-75-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-70-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-94-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2984-93-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2984-92-0x0000000000380000-0x0000000000381000-memory.dmp

            Filesize

            4KB

          • memory/2984-71-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-95-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-96-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB

          • memory/2984-69-0x00000000028B0000-0x000000000396A000-memory.dmp

            Filesize

            16.7MB