Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
21/05/2024, 11:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe
- Size 140KB
- Sample240521-nb7ttsbe6s
- SHA256 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944
- MD5 a25f8b146a3cace8d046f5ba6887b420
- SHA1 887b453da516ef93968f0abc1488fb93c8016e11
- SHA512 96ed2e65bf6987bf2cd580e555d6edddbef4020aaa00d7dee09d8810fc2d31ff5c39b20fb88f0c2d832a311454dbc567ed80c2466bac8a0106cfe21dd5ff4e43
- SSDEEP 1536:gKdp9H3yAgfopO1Ek93yAgf3TN2s+zheW6BVrqzCJ3bdDY+W14N4NmzWlIA7hKRa:g/bfwkAbfZ2lQBV+UdE+rECWp7hK7NSJ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O85858Z\\TuxO85858Z.exe\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M57051\\Ja178142bLay.com\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O85858Z\\TuxO85858Z.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M57051\\Ja178142bLay.com\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O85858Z\\TuxO85858Z.exe\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M57051\\Ja178142bLay.com\"" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O85858Z\\TuxO85858Z.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M57051\\Ja178142bLay.com\"" smss.exe - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" service.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" service.exe - Disables RegEdit via registry modification 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" service.exe - Sets file execution options in registry 2 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000022fbf-2.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe - Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd smss.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd EmangEloh.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd winlogon.exe - Executes dropped EXE 4 IoCs
pid Process 1508 service.exe 2996 smss.exe 1476 EmangEloh.exe 3632 winlogon.exe - Loads dropped DLL 1 IoCs
pid Process 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000a000000022fbf-2.dat upx behavioral2/memory/4784-6-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4784-143-0x0000000010000000-0x0000000010030000-memory.dmp upx - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T58Z385 = "C:\\Windows\\sa-77400.exe" service.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1570400TT4 = "C:\\Windows\\system32\\338508767185l.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T58Z385 = "C:\\Windows\\sa-77400.exe" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1570400TT4 = "C:\\Windows\\system32\\338508767185l.exe" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T58Z385 = "C:\\Windows\\sa-77400.exe" EmangEloh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1570400TT4 = "C:\\Windows\\system32\\338508767185l.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T58Z385 = "C:\\Windows\\sa-77400.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1570400TT4 = "C:\\Windows\\system32\\338508767185l.exe" service.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: service.exe File opened (read-only) \??\t: service.exe File opened (read-only) \??\x: service.exe File opened (read-only) \??\k: EmangEloh.exe File opened (read-only) \??\g: winlogon.exe File opened (read-only) \??\i: smss.exe File opened (read-only) \??\k: service.exe File opened (read-only) \??\v: winlogon.exe File opened (read-only) \??\q: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\j: service.exe File opened (read-only) \??\l: smss.exe File opened (read-only) \??\u: EmangEloh.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\y: EmangEloh.exe File opened (read-only) \??\o: winlogon.exe File opened (read-only) \??\s: winlogon.exe File opened (read-only) \??\i: service.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\o: service.exe File opened (read-only) \??\z: service.exe File opened (read-only) \??\p: EmangEloh.exe File opened (read-only) \??\u: winlogon.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\h: EmangEloh.exe File opened (read-only) \??\i: EmangEloh.exe File opened (read-only) \??\m: EmangEloh.exe File opened (read-only) \??\o: EmangEloh.exe File opened (read-only) \??\h: smss.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\y: service.exe File opened (read-only) \??\l: service.exe File opened (read-only) \??\N: service.exe File opened (read-only) \??\s: EmangEloh.exe File opened (read-only) \??\x: EmangEloh.exe File opened (read-only) \??\r: service.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\N: EmangEloh.exe File opened (read-only) \??\e: EmangEloh.exe File opened (read-only) \??\r: EmangEloh.exe File opened (read-only) \??\t: EmangEloh.exe File opened (read-only) \??\k: winlogon.exe File opened (read-only) \??\p: winlogon.exe File opened (read-only) \??\g: smss.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\w: EmangEloh.exe File opened (read-only) \??\z: EmangEloh.exe File opened (read-only) \??\h: service.exe File opened (read-only) \??\q: service.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\v: EmangEloh.exe File opened (read-only) \??\N: winlogon.exe File opened (read-only) \??\z: winlogon.exe File opened (read-only) \??\e: service.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\q: EmangEloh.exe File opened (read-only) \??\q: winlogon.exe File opened (read-only) \??\g: service.exe File opened (read-only) \??\g: EmangEloh.exe File opened (read-only) \??\l: winlogon.exe File opened (read-only) \??\y: winlogon.exe File opened (read-only) \??\s: service.exe - Drops file in System32 directory 32 IoCs
description ioc Process File created C:\Windows\SysWOW64\338508767185l.exe 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File created C:\Windows\SysWOW64\338508767185l.exe smss.exe File opened for modification C:\Windows\SysWOW64\338508767185l.exe winlogon.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\TutoriaL HAcking .exe service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\TutoriaL HAcking .exe service.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\TutoriaL HAcking .exe service.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Love Song .scr service.exe File opened for modification C:\Windows\SysWOW64\338508767185l.exe 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification C:\Windows\SysWOW64\338508767185l.exe smss.exe File created C:\Windows\SysWOW64\338508767185l.exe winlogon.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Titip Folder Jangan DiHapus .exe service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll EmangEloh.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\New mp3 BaraT !! .exe service.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Titip Folder Jangan DiHapus .exe service.exe File created C:\Windows\SysWOW64\X73556go\Z338508cie.cmd 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File created C:\Windows\SysWOW64\338508767185l.exe service.exe File opened for modification C:\Windows\SysWOW64\338508767185l.exe service.exe File created C:\Windows\SysWOW64\338508767185l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\338508767185l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\X73556go\Z338508cie.cmd service.exe File opened for modification C:\Windows\SysWOW64\X73556go\Z338508cie.cmd EmangEloh.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Titip Folder Jangan DiHapus .exe service.exe File opened for modification C:\Windows\SysWOW64\X73556go\Z338508cie.cmd smss.exe File opened for modification C:\Windows\SysWOW64\X73556go\Z338508cie.cmd winlogon.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Love Song .scr service.exe - Drops file in Program Files directory 28 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\Updates\Download\New mp3 BaraT !! .exe service.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Blink 182 .exe service.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Data DosenKu .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Lagu - Server .scr service.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Gallery .scr service.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Love Song .scr service.exe File created \??\c:\Program Files\dotnet\shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\TutoriaL HAcking .exe service.exe File created \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\New mp3 BaraT !! .exe service.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Blink 182 .exe service.exe File created \??\c:\Program Files (x86)\Google\Update\Download\New mp3 BaraT !! .exe service.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\New mp3 BaraT !! .exe service.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Windows Vista setup .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\Norman virus Control 5.18 .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\Updates\Download\New mp3 BaraT !! .exe service.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Lagu - Server .scr service.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Data DosenKu .exe service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\TutoriaL HAcking .exe service.exe File created \??\c:\Program Files\Common Files\microsoft shared\Windows Vista setup .scr service.exe File opened for modification \??\c:\Program Files\dotnet\shared\THe Best Ungu .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Love Song .scr service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\Norman virus Control 5.18 .exe service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Blink 182 .exe service.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\Gallery .scr service.exe File created C:\Program Files\Common Files\System\symsrv.dll 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\sa-77400.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\Lagu - Server .scr service.exe File created C:\Windows\M57051\EmangEloh.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\Lagu - Server .scr service.exe File created C:\Windows\M57051\Ja178142bLay.com EmangEloh.exe File created \??\c:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\Blink 182 .exe service.exe File opened for modification C:\Windows\system\msvbvm60.dll winlogon.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\Love Song .scr service.exe File created C:\Windows\M57051\smss.exe 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File created C:\Windows\sa-77400.exe smss.exe File created C:\Windows\M57051\Ja178142bLay.com winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\Gallery .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\Lagu - Server .scr service.exe File opened for modification C:\Windows\M57051 service.exe File created \??\c:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\Blink 182 .exe service.exe File created C:\Windows\Ti767185ta.exe 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File created \??\c:\Windows\InputMethod\SHARED\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\New mp3 BaraT !! .exe service.exe File opened for modification C:\Windows\M57051\EmangEloh.exe 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File created \??\c:\Windows\ServiceProfiles\LocalService\Downloads\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\Norman virus Control 5.18 .exe service.exe File opened for modification C:\Windows\Ti767185ta.exe winlogon.exe File opened for modification \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\Data DosenKu .exe service.exe File opened for modification C:\Windows\Ti767185ta.exe smss.exe File created \??\c:\Windows\SoftwareDistribution\Download\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\Blink 182 .exe service.exe File opened for modification C:\Windows\Ti767185ta.exe 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe File created C:\Windows\M57051\smss.exe winlogon.exe File opened for modification \??\c:\Windows\ServiceProfiles\LocalService\Downloads\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\Gallery .scr service.exe File created C:\Windows\Ti767185ta.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\Gallery .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\Love Song .scr service.exe File opened for modification \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\RaHasIA .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\Love Song .scr service.exe File created C:\Windows\M57051\smss.exe EmangEloh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\Windows Vista setup .scr service.exe File created C:\Windows\M57051\smss.exe smss.exe File created \??\c:\Windows\Downloaded Program Files\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\Titip Folder Jangan DiHapus .exe service.exe File created C:\Windows\Ti767185ta.exe winlogon.exe File created \??\c:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\Windows Vista setup .scr service.exe File opened for modification C:\Windows\M57051 winlogon.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\RaHasIA .exe service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EmangEloh.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 1508 service.exe 2996 smss.exe 1476 EmangEloh.exe 3632 winlogon.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4784 wrote to memory of 1508 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 84 PID 4784 wrote to memory of 1508 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 84 PID 4784 wrote to memory of 1508 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 84 PID 4784 wrote to memory of 2996 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 85 PID 4784 wrote to memory of 2996 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 85 PID 4784 wrote to memory of 2996 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 85 PID 4784 wrote to memory of 1476 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 86 PID 4784 wrote to memory of 1476 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 86 PID 4784 wrote to memory of 1476 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 86 PID 4784 wrote to memory of 3632 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 87 PID 4784 wrote to memory of 3632 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 87 PID 4784 wrote to memory of 3632 4784 3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3dbda0a2b8d764c9f833dc980a6739e0003c05ae96eeafa32c9af9ecaba09944_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O85858Z\service.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O85858Z\service.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1508
-
-
C:\Windows\M57051\smss.exe"C:\Windows\M57051\smss.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2996
-
-
C:\Windows\M57051\EmangEloh.exe"C:\Windows\M57051\EmangEloh.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1476
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O85858Z\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O85858Z\winlogon.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3632
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O85858Z\service.exe
- Size 64KB
- SHA256 11f04f6be74a26bf5612fe4fedbf220c262cc42450cbddeecd1ca60c1169fd86
- MD5 d0824d179d20045967001e30a65684e2
- SHA1 120be0c0bcb41b1b55d1e48aea7a14e8e807ae8a
- SHA512 e42ceebbb429a2b2a66483a563b037c2f3dd58bd2d3d07d5a3a5950eaec0a94042ef1455d9b65f952f779f131ae8aeab44f545411b499bc0737c7c8ce69358fa
- SSDEEP 768:wpUt1E/8mS+amkLFRccny45nHguULcpUt1E/8mS+amkLFRccny45nHguUL:wpO1Ek93yAgfopO1Ek93yAgf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\X73556go\Z338508cie.cmd
- Size 64KB
- SHA256 de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
- MD5 fcd6bcb56c1689fcef28b57c22475bad
- SHA1 1adc95bebe9eea8c112d40cd04ab7a8d75c4f961
- SHA512 73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\[TheMoonlight].txt
- Size 109B
- SHA256 883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec
- MD5 68c7836c8ff19e87ca33a7959a2bdff5
- SHA1 cc5d0205bb71c10bbed22fe47e59b1f6817daab7
- SHA512 3656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8
- MD5 SHA1 SHA512
- Path C:\Windows\system\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP