Analysis
- max time kernel
20s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
23 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe
- Size 292KB
- Sample240519-sr5fvscg33
- SHA256 269a7ea3b40b37add4b4c2d4336040d0bd96246294d202a43a509245af99dbac
- MD5 e2264b6655d9f86350c14dd0a0754420
- SHA1 d54b398509c8b6f23b800d6eeb1c5257cbd59f2b
- SHA512 52d3d537b6589cad6ea2bd6c00884e48114d33aee698defb3ecfcd4cd2502275b01e224009552db456ed3eeeb740a45b0a00cc0a142e467bfcd258a9f30b7032
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETY:mEFN+T5xYrllrU7QY6wLkIo6A9Y
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe - Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe - Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Deletes itself 1 IoCs
pid Process 448 explorer.exe - Executes dropped EXE 4 IoCs
pid Process 448 explorer.exe 4220 spoolsv.exe 5048 svchost.exe 3984 spoolsv.exe -
resource yara_rule behavioral2/memory/2988-1-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-3-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-5-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-4-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-18-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-13-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-14-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-21-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-7-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-6-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/2988-58-0x0000000002B80000-0x0000000003C0E000-memory.dmp upx behavioral2/memory/448-69-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-78-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-71-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-82-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-81-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-77-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-70-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-76-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-67-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-83-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-84-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-85-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-87-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-86-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-89-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-90-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-91-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-93-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-94-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-96-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-100-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-98-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-102-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-104-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-105-0x0000000003510000-0x000000000459E000-memory.dmp upx behavioral2/memory/448-107-0x0000000003510000-0x000000000459E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc explorer.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\H: explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\SYSTEM.INI e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\explorer.exe e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 448 explorer.exe 5048 svchost.exe 448 explorer.exe 5048 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 448 explorer.exe 5048 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Token: SeDebugPrivilege 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 448 explorer.exe 448 explorer.exe 4220 spoolsv.exe 4220 spoolsv.exe 5048 svchost.exe 5048 svchost.exe 3984 spoolsv.exe 3984 spoolsv.exe 448 explorer.exe 448 explorer.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2988 wrote to memory of 784 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 8 PID 2988 wrote to memory of 792 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 9 PID 2988 wrote to memory of 336 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 13 PID 2988 wrote to memory of 2500 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 42 PID 2988 wrote to memory of 2536 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 45 PID 2988 wrote to memory of 2852 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 49 PID 2988 wrote to memory of 3456 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 56 PID 2988 wrote to memory of 3644 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 57 PID 2988 wrote to memory of 3824 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 58 PID 2988 wrote to memory of 3952 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 59 PID 2988 wrote to memory of 4016 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 60 PID 2988 wrote to memory of 1044 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 61 PID 2988 wrote to memory of 3748 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 62 PID 2988 wrote to memory of 1948 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 73 PID 2988 wrote to memory of 4000 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 74 PID 2988 wrote to memory of 4060 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 75 PID 2988 wrote to memory of 984 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 80 PID 2988 wrote to memory of 2484 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 81 PID 2988 wrote to memory of 448 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 83 PID 2988 wrote to memory of 448 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 83 PID 2988 wrote to memory of 448 2988 e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe 83 PID 448 wrote to memory of 4220 448 explorer.exe 84 PID 448 wrote to memory of 4220 448 explorer.exe 84 PID 448 wrote to memory of 4220 448 explorer.exe 84 PID 4220 wrote to memory of 5048 4220 spoolsv.exe 85 PID 4220 wrote to memory of 5048 4220 spoolsv.exe 85 PID 4220 wrote to memory of 5048 4220 spoolsv.exe 85 PID 5048 wrote to memory of 3984 5048 svchost.exe 87 PID 5048 wrote to memory of 3984 5048 svchost.exe 87 PID 5048 wrote to memory of 3984 5048 svchost.exe 87 PID 5048 wrote to memory of 952 5048 svchost.exe 88 PID 5048 wrote to memory of 952 5048 svchost.exe 88 PID 5048 wrote to memory of 952 5048 svchost.exe 88 PID 448 wrote to memory of 784 448 explorer.exe 8 PID 448 wrote to memory of 792 448 explorer.exe 9 PID 448 wrote to memory of 336 448 explorer.exe 13 PID 448 wrote to memory of 2500 448 explorer.exe 42 PID 448 wrote to memory of 2536 448 explorer.exe 45 PID 448 wrote to memory of 2852 448 explorer.exe 49 PID 448 wrote to memory of 3456 448 explorer.exe 56 PID 448 wrote to memory of 3644 448 explorer.exe 57 PID 448 wrote to memory of 3824 448 explorer.exe 58 PID 448 wrote to memory of 3952 448 explorer.exe 59 PID 448 wrote to memory of 4016 448 explorer.exe 60 PID 448 wrote to memory of 1044 448 explorer.exe 61 PID 448 wrote to memory of 3748 448 explorer.exe 62 PID 448 wrote to memory of 1948 448 explorer.exe 73 PID 448 wrote to memory of 4000 448 explorer.exe 74 PID 448 wrote to memory of 4060 448 explorer.exe 75 PID 448 wrote to memory of 984 448 explorer.exe 80 PID 448 wrote to memory of 5048 448 explorer.exe 85 PID 448 wrote to memory of 5048 448 explorer.exe 85 PID 448 wrote to memory of 1216 448 explorer.exe 90 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2536
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2852
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2988 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Modifies Installed Components in the registry
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3984
-
-
C:\Windows\SysWOW64\at.exeat 15:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:952
-
-
C:\Windows\SysWOW64\at.exeat 15:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:228
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3748
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4060
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:984
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2484
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1216
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 292KB
- SHA256 7110f9fc47613d23d604e318da338257b85fbab65f3500954574b04c2a5fe6fd
- MD5 ffae855a88738150b8ba883388e5c0ff
- SHA1 edd77af1635ae610161a7a38d4e5f302a5737333
- SHA512 b30e075c73b4c56cf3f5b9d032c863299b68fce225ce2bb863b58b426cee391873220614a4482762bf66be59cbebc8f81bdf4a8105940a6379a7c95e8d2bd90a
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETm:mEFN+T5xYrllrU7QY6wLkIo6A9m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 e27de41f600b0106d2eb0023f49bc44ba17fa0c53de1b93ea2e10382531191e4
- MD5 0a5d4e3c92b0dd371e6fb84db8b504d7
- SHA1 6fb4e15422fd76b1c287f7f725ae6ce7420943a4
- SHA512 66c593e3c0dc4449d74fb57048104210de6fe852c1466e1d1f47b211501761cf541f7643da50e5fe8755c18c03d442f80620ee5df04a9bb051517dfffadcb2e1
- MD5 SHA1 SHA512
- Path C:\Windows\System\explorer.exe
- Size 292KB
- SHA256 41f2bdf17e9e551011a68feca1edd6a325a42853275d6ac67fc3557a2af84803
- MD5 bdcc0408237b9c4fcfdf430646a519d9
- SHA1 8f07e8450b028705d2c2130a1461f8dbce062c02
- SHA512 53414186ccbfbaf532bbc2cec536749ebcc69aebe1e2933c22b58d804cff605386b9ef7b5f9db6975f562fe71e7e4b12a6f290745c9776746242911a06a6e3ab
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETb:mEFN+T5xYrllrU7QY6wLkIo6A9b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 292KB
- SHA256 bb658f3adb630279b08949e40c783b2d79f67ed8121dfd0e2ebe84e4d84c7fce
- MD5 1fcc8df26da691a173732e7fd9f3ea91
- SHA1 37a1c4d763a182c1ca35ff304189fa149de30b86
- SHA512 998d8d0f6416fe5e3fe00529acb77f0b970a4d8e04b9d350c7643188212abb4c5115f813cd3b14351ffb5ddda4fd193f9e89bc6aa80173e668ba0536acc1bb38
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXET1:mEFN+T5xYrllrU7QY6wLkIo6A91
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 292KB
- SHA256 e691c0421162e5b603d6cf8301b225c3b24f0ce6d4b7b187a7298cf912ff5146
- MD5 a19964adcd3754e747f86d29634606e2
- SHA1 6a2638fbd50e4e9168a8b1ee9bfb0fe3f97b13e6
- SHA512 61c3f08e1d8f1a49b740cf77e2afc88cfe4faf16ed3c7662a338e7312fc13066435a8a69903953b7fa5044d57e27d7b9056d8ddeb780ecafcd55f8ae97052895
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXET/BBBBBBBBBBBBBBBBBBw:mEFN+T5xYrllrU7QY6wLkIo6A9/BBBBE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\dmlu.exe
- Size 100KB
- SHA256 4fb1ec4e385b730e7302afd6bb101326bc1a7f6a209fb18f94d8c3520c8020e1
- MD5 859b2c43074ce596fcd3c0535b5a64e2
- SHA1 c48531c7b21d0083a73b12275b4eae86e6450f4c
- SHA512 4990a9f27434514bf75ab13bded25a04a02e729c235a51e78ff8e95eaf289ff556ea8b0ef14a6311ef7c487b7456f49c9d6955904e17c28860acfe520336f5aa
- SSDEEP 1536:oAgqzuLRpliomKbpYF4aq2nMkkDGv8OtZaJD0aQdPxETXKt7YlH0mgvz5:oTLLTlpGFS2A+tE2Hd5EDKtCH/+l
- MD5 SHA1 SHA512 SSDEEP