Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:21
Static task
static1
Behavioral task
behavioral1
Sample
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe
-
Size
380KB
-
MD5
ffc6f59282bd9f74a606023447d1fe10
-
SHA1
43c575deeb1b9ef3eebccc5f137e7ad41a44043a
-
SHA256
7fb6311af5551e178515d8ec3127c90afa9c2deb5376ba0f8a30980d213719f1
-
SHA512
9e7eb6825667e7ec8ee938ee8a85cb99a00522211f2f2aac5d6288acce90e9e1963e0f7d1ec3a9ed8be942d7e911576bbbd449f4f86174416d5a5f175989870b
-
SSDEEP
6144:bzYwwTDaRFpzA0+NVweuGCE9G2+E7fXyEWTLgWq/taluBkdGwxXCe6Nq3FgD3ZEB:bzYwYDa3S0+NVweuGCk/4gWqgluBZw1D
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3992-0-0x00000000021D0000-0x00000000021FE000-memory.dmp family_blackmoon behavioral2/memory/3992-6-0x00000000021D0000-0x00000000021FE000-memory.dmp family_blackmoon behavioral2/memory/4628-7-0x00000000020F0000-0x000000000211E000-memory.dmp family_blackmoon behavioral2/memory/4628-11-0x00000000020F0000-0x000000000211E000-memory.dmp family_blackmoon -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
Processes:
HemsVNksBnB.exeHemsVNksBnB.exepid process 4628 HemsVNksBnB.exe 1744 HemsVNksBnB.exe -
Processes:
resource yara_rule behavioral2/memory/1744-12-0x0000000002220000-0x000000000222B000-memory.dmp upx behavioral2/memory/1744-13-0x00000000048B0000-0x00000000048BB000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exeHemsVNksBnB.exedescription ioc process File created C:\Windows\SysWOW64\HemsVNksBnB.exe ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\HemsVNksBnB.exe ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe File created C:\Windows\system32\HemsVNksBnB.exe HemsVNksBnB.exe File opened for modification C:\Windows\system32\HemsVNksBnB.exe HemsVNksBnB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 60 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exeHemsVNksBnB.exeHemsVNksBnB.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service HemsVNksBnB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 HemsVNksBnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exeHemsVNksBnB.exeHemsVNksBnB.exepid process 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 4628 HemsVNksBnB.exe 1744 HemsVNksBnB.exe 1744 HemsVNksBnB.exe 1744 HemsVNksBnB.exe 1744 HemsVNksBnB.exe 1744 HemsVNksBnB.exe 1744 HemsVNksBnB.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exepid process 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exeHemsVNksBnB.exedescription pid process Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe Token: SeLoadDriverPrivilege 4628 HemsVNksBnB.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exeHemsVNksBnB.exeHemsVNksBnB.exepid process 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe 4628 HemsVNksBnB.exe 1744 HemsVNksBnB.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.execmd.exeHemsVNksBnB.exedescription pid process target process PID 3992 wrote to memory of 4628 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe HemsVNksBnB.exe PID 3992 wrote to memory of 4628 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe HemsVNksBnB.exe PID 3992 wrote to memory of 4628 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe HemsVNksBnB.exe PID 3992 wrote to memory of 3152 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe cmd.exe PID 3992 wrote to memory of 3152 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe cmd.exe PID 3992 wrote to memory of 3152 3992 ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe cmd.exe PID 3152 wrote to memory of 748 3152 cmd.exe PING.EXE PID 3152 wrote to memory of 748 3152 cmd.exe PING.EXE PID 3152 wrote to memory of 748 3152 cmd.exe PING.EXE PID 4628 wrote to memory of 1744 4628 HemsVNksBnB.exe HemsVNksBnB.exe PID 4628 wrote to memory of 1744 4628 HemsVNksBnB.exe HemsVNksBnB.exe PID 4628 wrote to memory of 1744 4628 HemsVNksBnB.exe HemsVNksBnB.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ffc6f59282bd9f74a606023447d1fe10_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\HemsVNksBnB.exe-auto C:\Windows\system32\\HemsVNksBnB.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\HemsVNksBnB.exe-troj3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" cmd/c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\[email protected] > nul && exit2⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5ffc6f59282bd9f74a606023447d1fe10
SHA143c575deeb1b9ef3eebccc5f137e7ad41a44043a
SHA2567fb6311af5551e178515d8ec3127c90afa9c2deb5376ba0f8a30980d213719f1
SHA5129e7eb6825667e7ec8ee938ee8a85cb99a00522211f2f2aac5d6288acce90e9e1963e0f7d1ec3a9ed8be942d7e911576bbbd449f4f86174416d5a5f175989870b