Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 04:40
Behavioral task
behavioral1
Sample
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe
-
Size
130KB
-
MD5
762ed0a27d3f400bdd81d7de464dbbe0
-
SHA1
943ea1cce24991c60ad19caa247450f55160d392
-
SHA256
1b470f2f5e80b0505c2f00d7603d36b38a8580f1ad42761e41dcde66dad3e30a
-
SHA512
5bc877b4be86bbf745790c4479349e7bb47bbf4acb5aeb108021f78b0f6d44204e5acbbe9c80035b9bbb06e19fe3fe0749ed4ca330c98e80a5af0ed9005d9ff9
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZ2:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK8
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3552-52-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3552-48-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3552-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3552-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3552-60-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/3552-64-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 2900 Flaseher.exe 4048 Flaseher.exe 3552 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/1372-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1372-5-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4072-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4072-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4072-12-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1372-13-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4072-24-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/2900-37-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4072-42-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2900-43-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2900-44-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2900-45-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2900-58-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4072-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4048-63-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 1372 set thread context of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 2900 set thread context of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 set thread context of 3552 2900 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe Token: SeDebugPrivilege 4048 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 2900 Flaseher.exe 4048 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 1372 wrote to memory of 4072 1372 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe PID 4072 wrote to memory of 1080 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe cmd.exe PID 4072 wrote to memory of 1080 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe cmd.exe PID 4072 wrote to memory of 1080 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe cmd.exe PID 1080 wrote to memory of 4372 1080 cmd.exe reg.exe PID 1080 wrote to memory of 4372 1080 cmd.exe reg.exe PID 1080 wrote to memory of 4372 1080 cmd.exe reg.exe PID 4072 wrote to memory of 2900 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe Flaseher.exe PID 4072 wrote to memory of 2900 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe Flaseher.exe PID 4072 wrote to memory of 2900 4072 762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 4048 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe PID 2900 wrote to memory of 3552 2900 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\762ed0a27d3f400bdd81d7de464dbbe0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IHUBK.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
PID:4372 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4048 -
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
PID:3552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IHUBK.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD5242a70543e3a89f28029a3ad4fb71966
SHA1983dfab2db53d302bdcf4eab507dd76e2fd6e0b7
SHA25687b4a89bb4122a82aeea1fd41a4c2a3fb385d240a1f4e987059e18fc5bb5301e
SHA5122f1f7014b2fc6a7b5cc8733576817bc5efdebf81fd0df85429e338f79efa01195b7d88b50e83e2488f95387f6288f66111928ea56af731e418edd6089fd79ad9
-
memory/1372-8-0x0000000002CA0000-0x0000000002CA1000-memory.dmpFilesize
4KB
-
memory/1372-5-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1372-7-0x0000000002C50000-0x0000000002C51000-memory.dmpFilesize
4KB
-
memory/1372-6-0x0000000002C20000-0x0000000002C21000-memory.dmpFilesize
4KB
-
memory/1372-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1372-13-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1372-3-0x0000000002BB0000-0x0000000002BB1000-memory.dmpFilesize
4KB
-
memory/1372-4-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/2900-43-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2900-58-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2900-45-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2900-44-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2900-37-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3552-54-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3552-52-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3552-48-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3552-59-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3552-60-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/3552-64-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4048-63-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4072-42-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4072-24-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4072-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4072-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4072-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4072-61-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB