Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe
-
Size
4.1MB
-
MD5
2389a9e9bcb688f5d8d0a5b5e3f226d0
-
SHA1
c9e218555305b5d6a765b2a954f68644743761ca
-
SHA256
4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d
-
SHA512
201bbdd9ca0eddba8ab41f671721d52cab591892532668c5fa3d8eee3db137c87d85ba78b529bcdb5dc4b66c8fe0e273a3288b435feda10a1091d4da901ed0ec
-
SSDEEP
98304:4Z9bi3QNEOtUId2petU9sYIhWVMAA4+HC:R303UIApyYIhWVMEf
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral2/memory/464-2-0x0000000004DA0000-0x000000000568B000-memory.dmp family_glupteba behavioral2/memory/464-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4044-130-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/464-134-0x0000000004DA0000-0x000000000568B000-memory.dmp family_glupteba behavioral2/memory/464-133-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/464-206-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3756-213-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-215-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-217-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-219-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-221-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-223-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-225-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-227-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-229-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-231-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-233-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-235-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba behavioral2/memory/3756-237-0x0000000000400000-0x0000000002B08000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2440 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 3756 csrss.exe 1532 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe File created C:\Windows\rss\csrss.exe 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe -
pid Process 2320 powershell.exe 3956 powershell.exe 2560 powershell.exe 2544 powershell.exe 1216 powershell.exe 2300 powershell.exe 2880 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2092 schtasks.exe 4792 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 powershell.exe 1216 powershell.exe 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 2300 powershell.exe 2300 powershell.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 2880 powershell.exe 2880 powershell.exe 2880 powershell.exe 2320 powershell.exe 2320 powershell.exe 2320 powershell.exe 3956 powershell.exe 3956 powershell.exe 3956 powershell.exe 2560 powershell.exe 2560 powershell.exe 2544 powershell.exe 2544 powershell.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 3756 csrss.exe 3756 csrss.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 3756 csrss.exe 3756 csrss.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe 1532 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Token: SeImpersonatePrivilege 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe Token: SeDebugPrivilege 2300 powershell.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 2320 powershell.exe Token: SeDebugPrivilege 3956 powershell.exe Token: SeDebugPrivilege 2560 powershell.exe Token: SeDebugPrivilege 2544 powershell.exe Token: SeSystemEnvironmentPrivilege 3756 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 464 wrote to memory of 1216 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 85 PID 464 wrote to memory of 1216 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 85 PID 464 wrote to memory of 1216 464 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 85 PID 4044 wrote to memory of 2300 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 95 PID 4044 wrote to memory of 2300 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 95 PID 4044 wrote to memory of 2300 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 95 PID 4044 wrote to memory of 4088 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 97 PID 4044 wrote to memory of 4088 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 97 PID 4088 wrote to memory of 2440 4088 cmd.exe 99 PID 4088 wrote to memory of 2440 4088 cmd.exe 99 PID 4044 wrote to memory of 2880 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 102 PID 4044 wrote to memory of 2880 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 102 PID 4044 wrote to memory of 2880 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 102 PID 4044 wrote to memory of 2320 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 104 PID 4044 wrote to memory of 2320 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 104 PID 4044 wrote to memory of 2320 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 104 PID 4044 wrote to memory of 3756 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 107 PID 4044 wrote to memory of 3756 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 107 PID 4044 wrote to memory of 3756 4044 4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe 107 PID 3756 wrote to memory of 3956 3756 csrss.exe 108 PID 3756 wrote to memory of 3956 3756 csrss.exe 108 PID 3756 wrote to memory of 3956 3756 csrss.exe 108 PID 3756 wrote to memory of 2560 3756 csrss.exe 115 PID 3756 wrote to memory of 2560 3756 csrss.exe 115 PID 3756 wrote to memory of 2560 3756 csrss.exe 115 PID 3756 wrote to memory of 2544 3756 csrss.exe 117 PID 3756 wrote to memory of 2544 3756 csrss.exe 117 PID 3756 wrote to memory of 2544 3756 csrss.exe 117 PID 3756 wrote to memory of 1532 3756 csrss.exe 119 PID 3756 wrote to memory of 1532 3756 csrss.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Users\Admin\AppData\Local\Temp\4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2440
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2092
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4792
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a7f7ea7b398ce713ab7a8c197358f8a5
SHA156d1cc1e548468c8b2e4db88b37d0a805f80c4ef
SHA256cfa4bc1418ae74c52d4e1b56e961ccb5237bc119be08883cc9eef9258089e77f
SHA512b2cb611ba507497b0faecea81cd9a688757cbdbcf503299fafc277386b90ace00c36eba9e5f28a940583b24e2a40219b48ac65d5dd6d3f30c928543ebc7399e5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54772b04ff49df472339eaefaefd77363
SHA1371c7cdd1cbab3ca7584e2161488eb5079045a13
SHA256635f605e7c166eefd1b0e5f3c50ff81585d4c85a40511fce93a6a665e92dd3dc
SHA512d31af5904c951c3e6dc14a2dcc5084ff5ab64ddd1fa0665ad3d2442d9751d96d8120a0660719b159bd89100f5211b59d93b3816ad10cebd7636d991a811165a9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD577e6067ad933c9ff1bef7b9eb9c73388
SHA1a5fb32a03f60308e5dde175c784bd2ffe478462f
SHA256d538119739baf56d98865427e151bf99ec15b082f43735b6346683223cda9b00
SHA512d254ab6dc54c10441b3e7a04ea8eb302d4221d3df12e32be4848d389933aa60f57da868f8375a4dd55cd460a560e022f7325295a010b812e28cf7d3ea4649daa
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD55cc4d4d15e5106c4b0890e0391302eaf
SHA10ec96cdbd201f3b549edcaf74879a1cadf7c4f07
SHA2560f689f0d53fa53ba53094305187b238b880180c0cd9f57b68edf251537734f24
SHA512ee75c7ab47ced0809ae969aa80ea2cb095b35c2a0a0c1bf07e3f06940d14476965db6fbfc7550385006cc90533870a09842e93a90353df8404a527a6e14c46f0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51a7baac16b738b4f16956602d3174aaa
SHA1da8dc5080580618a8d2884ba68bd336960711ad0
SHA256400437ac332dad93d46413891a9eae6933805a175fa001d8f28de18c3f821fed
SHA512295be62b98ef38bac1fb0578e11749f1ddb7b2b56a3be31e0081fc55e8861564114665c6d0270caa6f6fb196211a1bdd4f3df8d625168bf52baf1b127fdf82bd
-
Filesize
4.1MB
MD52389a9e9bcb688f5d8d0a5b5e3f226d0
SHA1c9e218555305b5d6a765b2a954f68644743761ca
SHA2564f9226c5fd2b6cdfa82cde7be4019c7fcab1c838a352a766b9d47de8f3f9526d
SHA512201bbdd9ca0eddba8ab41f671721d52cab591892532668c5fa3d8eee3db137c87d85ba78b529bcdb5dc4b66c8fe0e273a3288b435feda10a1091d4da901ed0ec