Analysis
-
max time kernel
136s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:25
Behavioral task
behavioral1
Sample
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe
-
Size
283KB
-
MD5
d34affe27303efd466527f7e2580a950
-
SHA1
515522de0fc8f037c5f5800b1c1db784f5390b87
-
SHA256
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1
-
SHA512
930d9a31e7e141a8c4af56cac68fb5d0e676c8b2ddb7acc77334dde474f8eeb33ca4295983eb76f3e9d8e6b0890b79f5c647110286c9b17e7059b9ada8b9504f
-
SSDEEP
6144:VcNYS99KGGyqRFIqU7lT73sctFM7Pz4pSXJSzAnh:VcWB1zktFSUxAh
Malware Config
Extracted
darkcomet
Slave
bssbig.no-ip.org:699
zymic99k.no-ip.org:699
DC_MUTEX-9UYCUYX
-
InstallPath
winlogon.exe
-
gencode
6dYodXAtJ1da
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
winlogon
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\winlogon.exe" 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2896 attrib.exe 4064 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/1404-0-0x0000000000400000-0x00000000004C7000-memory.dmp upx C:\Windows\SysWOW64\winlogon.exe upx behavioral2/memory/1404-62-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windows\\system32\\winlogon.exe" 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe -
Drops file in System32 directory 3 IoCs
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\winlogon.exe 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\winlogon.exe 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exedescription pid process Token: SeIncreaseQuotaPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeSecurityPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeTakeOwnershipPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeLoadDriverPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeSystemProfilePrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeSystemtimePrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeProfSingleProcessPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeIncBasePriorityPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeCreatePagefilePrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeBackupPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeRestorePrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeShutdownPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeDebugPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeSystemEnvironmentPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeChangeNotifyPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeRemoteShutdownPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeUndockPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeManageVolumePrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeImpersonatePrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: SeCreateGlobalPrivilege 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: 33 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: 34 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: 35 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe Token: 36 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.execmd.execmd.exedescription pid process target process PID 1404 wrote to memory of 1464 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe cmd.exe PID 1404 wrote to memory of 1464 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe cmd.exe PID 1404 wrote to memory of 1464 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe cmd.exe PID 1404 wrote to memory of 3972 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe cmd.exe PID 1404 wrote to memory of 3972 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe cmd.exe PID 1404 wrote to memory of 3972 1404 4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe cmd.exe PID 1464 wrote to memory of 2896 1464 cmd.exe attrib.exe PID 1464 wrote to memory of 2896 1464 cmd.exe attrib.exe PID 1464 wrote to memory of 2896 1464 cmd.exe attrib.exe PID 3972 wrote to memory of 4064 3972 cmd.exe attrib.exe PID 3972 wrote to memory of 4064 3972 cmd.exe attrib.exe PID 3972 wrote to memory of 4064 3972 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2896 attrib.exe 4064 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\4a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1_NeikiAnalytics.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\winlogon.exeFilesize
283KB
MD5d34affe27303efd466527f7e2580a950
SHA1515522de0fc8f037c5f5800b1c1db784f5390b87
SHA2564a05ce132b97e62e2d53803e7f89d02bd3c57424e62699aea43c098fc1455fa1
SHA512930d9a31e7e141a8c4af56cac68fb5d0e676c8b2ddb7acc77334dde474f8eeb33ca4295983eb76f3e9d8e6b0890b79f5c647110286c9b17e7059b9ada8b9504f
-
memory/1404-0-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1404-1-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1404-62-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB