3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796

Analysis

max time kernel
130s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe
Size

76KB
MD5

2ab58296b3710a838e7efe71fc1eb720
SHA1

073e29a2b66435357650ca1d76ae3065f5358575
SHA256

3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796
SHA512

9b2d2716033a77c4a2c9f5f91d5db76182fc4282744610ee3751307fe057c83d863209b9ad7ba9052a756582397208ca4227d9ec87166f281f6a41cdb08be281
SSDEEP

1536:abSshapMJgKJUuxGmfJPtOgqm1s/XZSWcHW:K25KJFjfJPtOgqm2/XZXP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1876	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
224	1876	WerFault.exe	82
2560	552	WerFault.exe	81

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
552	3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe
1876	winlgon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1876	552	3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe	82
PID 552 wrote to memory of 1876	552	3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe	82
PID 552 wrote to memory of 1876	552	3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3e170e6428b7a264d5a37830ec4697e6f4c52a5f8a05965a0f5ad31de4b51796_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 676
    3⤵
    - Program crash
    PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 600
  2⤵
  - Program crash
  PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1876 -ip 1876
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 552 -ip 552
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winlgon.exe

Filesize
77KB

MD5
6f150f48d979c8e3f611f21e57024fa3

SHA1
480ca2e19da8fa21916d2a2ff3f62b2ec21cc609

SHA256
c37dc3ece62259ed492aaa8c521ec2cfcf69b82b80f698295472aa4791f07840

SHA512
d748971618bd6ee976f052627d671da24f00810cf619810cc4472e054909644bbbf1cb58548dc5f7e2a83221140d41b6b099d321ba505101a17c275f90d38790

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads