01b44b214e47181e0137727664164465e4ddec38f1e609ab719aeea251c81711

General

Target

80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe
Size

244KB
MD5

80e18e7a9d4cf6e395d6868659d54ef0
SHA1

07df7984998c0bf8e2ebecca5857b4e754498e59
SHA256

01b44b214e47181e0137727664164465e4ddec38f1e609ab719aeea251c81711
SHA512

123d4114ba86f8fa4e6254509331bdb66aa3300e63dac24526aef4d241359e7b9da82b78eacc1d3fdce8375487ea8959ad3d85929c20ac98e7868c367edc14b5
SSDEEP

6144:9EXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5EmX:eAylvv5YRwh9HYd61xhmX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1632	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe
1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe
2500	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\593715b2 = "C:\\Windows\\apppatch\\svchost.exe"	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\593715b2 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	1632	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1632	1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 1632	1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 1632	1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe	28
PID 1656 wrote to memory of 1632	1656	80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe	28
PID 1632 wrote to memory of 2500	1632	svchost.exe	29
PID 1632 wrote to memory of 2500	1632	svchost.exe	29
PID 1632 wrote to memory of 2500	1632	svchost.exe	29
PID 1632 wrote to memory of 2500	1632	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\80e18e7a9d4cf6e395d6868659d54ef0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 496
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\svchost.exe

Filesize
244KB

MD5
7284bda0563b1b4b778f39532398cd2c

SHA1
8c03dacb3fd6ca0388539ac6a2633ade1315f4fe

SHA256
3f4d4e24bee2371a67ca0ca4a9a76347a9d8092dc60861efb403aaac8b36d097

SHA512
073ccf25250c9fa549f23be480c3853e00f10bf413963697604bd57f6166256d92bb03e45890622e221c249657746c7412d24f07e9240951b807247c75fb693a

Download Submit
memory/1632-23-0x00000000003B0000-0x00000000003FA000-memory.dmp

Filesize
296KB

Download
memory/1632-25-0x00000000003B0000-0x00000000003FA000-memory.dmp

Filesize
296KB

Download
memory/1632-33-0x0000000001DC0000-0x0000000001E18000-memory.dmp

Filesize
352KB

Download
memory/1632-35-0x0000000001DC0000-0x0000000001E18000-memory.dmp

Filesize
352KB

Download
memory/1632-31-0x0000000001DC0000-0x0000000001E18000-memory.dmp

Filesize
352KB

Download
memory/1632-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1632-30-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1632-27-0x00000000003B0000-0x00000000003FA000-memory.dmp

Filesize
296KB

Download
memory/1632-29-0x00000000003B0000-0x00000000003FA000-memory.dmp

Filesize
296KB

Download
memory/1632-21-0x00000000003B0000-0x00000000003FA000-memory.dmp

Filesize
296KB

Download
memory/1632-17-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1656-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1656-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1656-19-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1656-18-0x0000000000310000-0x0000000000378000-memory.dmp

Filesize
416KB

Download
memory/1656-1-0x0000000000310000-0x0000000000378000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads