Analysis
-
max time kernel
135s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 16:18
Static task
static1
Behavioral task
behavioral1
Sample
f02366008723d90c72f974ae24533210_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
f02366008723d90c72f974ae24533210_NeikiAnalytics.exe
-
Size
1.0MB
-
MD5
f02366008723d90c72f974ae24533210
-
SHA1
4cd7b2aa4ccfcdff69cb9d8b67f7df7875b75efb
-
SHA256
07e77740d3a69d40ef35d6e7609a9498233ec93a0f8b84febdfda241a4f22849
-
SHA512
c2aee270e0277607023c458eb393314a867b8ac670eb87da22b04d586f6d1d8fcaa21f87b73181db7dfb32590dfcc2577bc8ca8cd76e3306c1ad6e1d83660ffa
-
SSDEEP
24576:zQ5aILMCfmAUhrSO1YNWdvCzMPqdUD6dNXfppC:E5aIwC+AUBsWsXs
Malware Config
Signatures
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1976-15-0x0000000000340000-0x0000000000369000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
f02377009823d90c82f984ae24633210_NeikiAnalytict.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exepid process 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 2012 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 1616 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe -
Loads dropped DLL 2 IoCs
Processes:
f02366008723d90c72f974ae24533210_NeikiAnalytics.exepid process 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2960 sc.exe 2356 sc.exe 2264 sc.exe 844 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f02366008723d90c72f974ae24533210_NeikiAnalytics.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exepowershell.exepowershell.exepid process 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 2720 powershell.exe 2564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exedescription pid process Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 2564 powershell.exe Token: SeTcbPrivilege 2012 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe Token: SeTcbPrivilege 1616 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
f02366008723d90c72f974ae24533210_NeikiAnalytics.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exepid process 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 2012 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe 1616 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f02366008723d90c72f974ae24533210_NeikiAnalytics.execmd.execmd.execmd.exef02377009823d90c82f984ae24633210_NeikiAnalytict.exedescription pid process target process PID 1976 wrote to memory of 2520 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2520 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2520 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2520 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2000 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2000 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2000 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2000 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2532 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2532 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2532 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2532 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe cmd.exe PID 1976 wrote to memory of 2656 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe f02377009823d90c82f984ae24633210_NeikiAnalytict.exe PID 1976 wrote to memory of 2656 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe f02377009823d90c82f984ae24633210_NeikiAnalytict.exe PID 1976 wrote to memory of 2656 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe f02377009823d90c82f984ae24633210_NeikiAnalytict.exe PID 1976 wrote to memory of 2656 1976 f02366008723d90c72f974ae24533210_NeikiAnalytics.exe f02377009823d90c82f984ae24633210_NeikiAnalytict.exe PID 2000 wrote to memory of 2960 2000 cmd.exe sc.exe PID 2000 wrote to memory of 2960 2000 cmd.exe sc.exe PID 2000 wrote to memory of 2960 2000 cmd.exe sc.exe PID 2000 wrote to memory of 2960 2000 cmd.exe sc.exe PID 2520 wrote to memory of 2356 2520 cmd.exe sc.exe PID 2520 wrote to memory of 2356 2520 cmd.exe sc.exe PID 2520 wrote to memory of 2356 2520 cmd.exe sc.exe PID 2520 wrote to memory of 2356 2520 cmd.exe sc.exe PID 2532 wrote to memory of 2564 2532 cmd.exe powershell.exe PID 2532 wrote to memory of 2564 2532 cmd.exe powershell.exe PID 2532 wrote to memory of 2564 2532 cmd.exe powershell.exe PID 2532 wrote to memory of 2564 2532 cmd.exe powershell.exe PID 2656 wrote to memory of 2592 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2592 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2592 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2592 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2540 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2540 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2540 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2540 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2480 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2480 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2480 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2480 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe cmd.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe PID 2656 wrote to memory of 2440 2656 f02377009823d90c82f984ae24633210_NeikiAnalytict.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f02366008723d90c72f974ae24533210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f02366008723d90c72f974ae24533210_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {ED3F262A-339F-4B2D-9BC6-27009D38F3AF} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55dd35c802a92309839c86c3b669c8230
SHA1e9808531879eda6bb651b4ec152907cb48676aba
SHA25679a10879d69679616d73e80ffc3413a4ab5d6cc7c1bb76e1943fda097508e7d6
SHA51284a272463e19b3bf10decb18950f0da711cce563b09a90b9bea368cef3542999d1f662b5eea60858511257a6747be20a2679a598d54e01f5938f9c296dc54651
-
\Users\Admin\AppData\Roaming\WinSocket\f02377009823d90c82f984ae24633210_NeikiAnalytict.exeFilesize
1.0MB
MD5f02366008723d90c72f974ae24533210
SHA14cd7b2aa4ccfcdff69cb9d8b67f7df7875b75efb
SHA25607e77740d3a69d40ef35d6e7609a9498233ec93a0f8b84febdfda241a4f22849
SHA512c2aee270e0277607023c458eb393314a867b8ac670eb87da22b04d586f6d1d8fcaa21f87b73181db7dfb32590dfcc2577bc8ca8cd76e3306c1ad6e1d83660ffa
-
memory/1976-3-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-9-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-10-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-13-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-8-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-7-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-6-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-5-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-4-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-14-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1976-15-0x0000000000340000-0x0000000000369000-memory.dmpFilesize
164KB
-
memory/1976-11-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1976-12-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1976-2-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2012-74-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-75-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-76-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-77-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-78-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-72-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-69-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-73-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-71-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-67-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-68-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2012-70-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2440-50-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2656-37-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-35-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-34-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-46-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2656-32-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-33-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-39-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-41-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-36-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-40-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-38-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-44-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2656-30-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2656-45-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2656-31-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB