814ffaf1e3a33e2a9d96af59cb386baf994f548094b529961fd87b282d077986

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe
Size

217KB
MD5

99f386d95a0278bb887637ddf9110630
SHA1

46f0bcfc86b853a320065fd09642a7e077d6d837
SHA256

814ffaf1e3a33e2a9d96af59cb386baf994f548094b529961fd87b282d077986
SHA512

32b607e7bc1ab707787d29241c06f6748589f9db3152efd9a6c18117246016a82df94e85a8ef7037d03d812043a3328ccf9a9cf905b2b782ff1a1fd9e79444dc
SSDEEP

6144:PnyiqVQBf0EaIp8fkTJJsK1eEzEB1XjrkXb:gEdp8csKpE7XX

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
556	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\eedcdfa4 = "C:\\Windows\\apppatch\\svchost.exe"	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\gadyciz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qexyhuv.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vocyzit.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\pupycag.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\galynuh.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qegyval.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qetyhyg.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\galyqaz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lymyxid.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\pupydeq.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lyxynyx.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\gahyhiz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qetyfuv.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vofycot.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lygyvuj.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vonypom.com	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\Local Settings\MuiCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
556	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe
Token: SeSecurityPrivilege	2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe
Token: SeSecurityPrivilege	556	svchost.exe
Token: SeSecurityPrivilege	556	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 556	2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 556	2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 556	2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe	28
PID 2180 wrote to memory of 556	2180	99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\99f386d95a0278bb887637ddf9110630_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28be9bbac0763b7d97502d4746f4c59f

SHA1
ba6a949fefc7cfb4991c40a6fcea43bd4f25c61f

SHA256
8aa1b9cf11666df6b55fddca0e223dc34161477dbf4cb9331f7101847d96e2c6

SHA512
75ae7964814e628bb37d1077124dce5d8da6f5909134cf9b11da5484fc748a5e69da79b9025e3a4a6ccbb8bafe7cfa7d09c1aa8a378b601224c84d1d7f4077cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\Cab3A66.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Temp\Tar3AC7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Windows\AppPatch\svchost.exe

Filesize
217KB

MD5
072fbcbf43472a0b4f7fbac00d3f26a3

SHA1
07b4a5fdd549cc91c941682b28ac97744e5a09f1

SHA256
e173d29e65203ebc74a5675f3c67b612e8e9940f72a854ebaa7fc56925cfb7d4

SHA512
0ef01287efea696374999bf5c8db50c1c574701cdb97c50f0b1b6c4312ac6a66a218b1a503dd985141ec1d4297779d3b402afec90302460ca33c7287156e3adf

Download Submit
memory/556-65-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-53-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-17-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/556-27-0x0000000002330000-0x00000000023DA000-memory.dmp

Filesize
680KB

Download
memory/556-25-0x0000000002330000-0x00000000023DA000-memory.dmp

Filesize
680KB

Download
memory/556-21-0x0000000002330000-0x00000000023DA000-memory.dmp

Filesize
680KB

Download
memory/556-23-0x0000000002330000-0x00000000023DA000-memory.dmp

Filesize
680KB

Download
memory/556-30-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/556-31-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-33-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-35-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-42-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-54-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-82-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-81-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-80-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-79-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-78-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-77-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-76-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-75-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-74-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-73-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-72-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-71-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-70-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-69-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-68-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-67-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-66-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/556-62-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-29-0x0000000002330000-0x00000000023DA000-memory.dmp

Filesize
680KB

Download
memory/556-64-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-61-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-60-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-59-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-58-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-57-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-56-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-63-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-52-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-83-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-51-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-50-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-49-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-48-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-47-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-46-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-45-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-44-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-43-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-55-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-41-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-40-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-39-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-38-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-37-0x0000000002580000-0x0000000002637000-memory.dmp

Filesize
732KB

Download
memory/556-19-0x0000000002330000-0x00000000023DA000-memory.dmp

Filesize
680KB

Download
memory/2180-0-0x0000000000270000-0x0000000000273000-memory.dmp

Filesize
12KB

Download
memory/2180-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2180-14-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2180-16-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2180-15-0x0000000000270000-0x0000000000273000-memory.dmp

Filesize
12KB

Download