Analysis
-
max time kernel
17s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:59
Static task
static1
Behavioral task
behavioral1
Sample
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe
-
Size
732KB
-
MD5
3b94744c1af3863468425acb2d086870
-
SHA1
e8e04d433b325e7c6f7375ed90eb6f44bddb4a50
-
SHA256
7286faa87d9761ae37f4cd3122865b829f2cab42eff87a3ffba01047929e508a
-
SHA512
bf12103aa593d6a4d5fa8325c22f26487b718865c278dc1a740780490c6ac1438db082bfbfcf1847be18c449076c4cc3db7c1289a2104f84863cac348ca639e7
-
SSDEEP
12288:ITyjXW+48qWywrU4kGFezOAVuJ5PIqww7F5DO3HYff8vt8nF:GIXW/8yw1ez54lIUF5SXYH0+nF
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 2364 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/700-3-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-1-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-6-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-16-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-15-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-23-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-5-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-18-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-7-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-24-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-25-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-26-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-29-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/700-36-0x0000000003330000-0x00000000043EA000-memory.dmp upx behavioral2/memory/2364-61-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-70-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-72-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-69-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-60-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-57-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-56-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-55-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-53-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-58-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-59-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-75-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-74-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-76-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-77-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-78-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-80-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-81-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-82-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-84-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-86-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-88-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-87-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-91-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-93-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx behavioral2/memory/2364-113-0x0000000004EE0000-0x0000000005F9A000-memory.dmp upx -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\U: rundll32.exe -
Drops file in Windows directory 3 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process File created C:\Windows\e5743a0 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe File created C:\Windows\e577501 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exepid process 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 2364 rundll32.exe 2364 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exepid process 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 2364 rundll32.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription pid process target process PID 700 wrote to memory of 780 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe fontdrvhost.exe PID 700 wrote to memory of 788 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe fontdrvhost.exe PID 700 wrote to memory of 316 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe dwm.exe PID 700 wrote to memory of 2476 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe sihost.exe PID 700 wrote to memory of 2500 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe svchost.exe PID 700 wrote to memory of 2664 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe taskhostw.exe PID 700 wrote to memory of 3160 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Explorer.EXE PID 700 wrote to memory of 3672 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe svchost.exe PID 700 wrote to memory of 3864 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe DllHost.exe PID 700 wrote to memory of 3956 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 700 wrote to memory of 4024 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe RuntimeBroker.exe PID 700 wrote to memory of 388 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe SearchApp.exe PID 700 wrote to memory of 3992 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe RuntimeBroker.exe PID 700 wrote to memory of 436 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe RuntimeBroker.exe PID 700 wrote to memory of 2536 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe TextInputHost.exe PID 700 wrote to memory of 2956 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe backgroundTaskHost.exe PID 700 wrote to memory of 5020 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe backgroundTaskHost.exe PID 700 wrote to memory of 2364 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 700 wrote to memory of 2364 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 700 wrote to memory of 2364 700 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 2364 wrote to memory of 780 2364 rundll32.exe fontdrvhost.exe PID 2364 wrote to memory of 788 2364 rundll32.exe fontdrvhost.exe PID 2364 wrote to memory of 316 2364 rundll32.exe dwm.exe PID 2364 wrote to memory of 2476 2364 rundll32.exe sihost.exe PID 2364 wrote to memory of 2500 2364 rundll32.exe svchost.exe PID 2364 wrote to memory of 2664 2364 rundll32.exe taskhostw.exe PID 2364 wrote to memory of 3160 2364 rundll32.exe Explorer.EXE PID 2364 wrote to memory of 3672 2364 rundll32.exe svchost.exe PID 2364 wrote to memory of 3864 2364 rundll32.exe DllHost.exe PID 2364 wrote to memory of 3956 2364 rundll32.exe StartMenuExperienceHost.exe PID 2364 wrote to memory of 4024 2364 rundll32.exe RuntimeBroker.exe PID 2364 wrote to memory of 388 2364 rundll32.exe SearchApp.exe PID 2364 wrote to memory of 3992 2364 rundll32.exe RuntimeBroker.exe PID 2364 wrote to memory of 436 2364 rundll32.exe RuntimeBroker.exe PID 2364 wrote to memory of 2536 2364 rundll32.exe TextInputHost.exe PID 2364 wrote to memory of 2956 2364 rundll32.exe backgroundTaskHost.exe PID 2364 wrote to memory of 1892 2364 rundll32.exe RuntimeBroker.exe PID 2364 wrote to memory of 3400 2364 rundll32.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
rundll32.exe3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2500
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2664
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:700 -
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2364
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3672
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3956
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:388
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:436
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2536
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2956
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5020
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1892
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3400
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
Filesize
732KB
MD53b94744c1af3863468425acb2d086870
SHA1e8e04d433b325e7c6f7375ed90eb6f44bddb4a50
SHA2567286faa87d9761ae37f4cd3122865b829f2cab42eff87a3ffba01047929e508a
SHA512bf12103aa593d6a4d5fa8325c22f26487b718865c278dc1a740780490c6ac1438db082bfbfcf1847be18c449076c4cc3db7c1289a2104f84863cac348ca639e7
-
Filesize
257B
MD5cf078fe7cba1e80a6d6fce26fe36716a
SHA1eb457dd1649a7387a92d060ba1d27394d85a305a
SHA256cfe46b4fb340aa3f1b7b12ceba168cde126fff81e6c2d68048e62ba074a1b5a1
SHA512cd2c79fc2d0a9ab715bd94863370f3be1f48452139ab4a47c49a5091d938716fe469a9ce348e38969adc9cf5de907009472530054265fc865dd955c974dd046d
-
Filesize
97KB
MD51d7b6137c06486ced9254e0b617177c1
SHA16e2731c495e7d4436198efa6304bfb87ec38a8c0
SHA256b8cc5155d127db73d32b7beb464f2d398a01ed162b5ec78f89a90749d580003f
SHA5126e5aa40c2cfb358be7d319ceb8306e6542320d7ebb6ad1c4a10975e5a2ecfc01d938f2c24e442edd3c599d181f1505055b99d250553c48c98aeea5d5ef0f4455