c60f3790018d9dcb3433df7a2928977853635d440a3ba1284873607a1faf8d0d

General

Target

0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
Size

72KB
MD5

0cebffcc508b9c908596fe6233d0b410
SHA1

ecbcf8bcca3e54ecde58a1ac6b19e2e15b1fb113
SHA256

c60f3790018d9dcb3433df7a2928977853635d440a3ba1284873607a1faf8d0d
SHA512

fa80a4729c1b2de9e63e969659d0eeac75efe554579e5a234260824b9a29a7a0d7cfbcad6d0542322ea6426b88c01fc99524b13f44abbc7cc36c6b596931f692
SSDEEP

768:x/nGhX+OZMUpVzJKsMIWqH3N7GLCMa7kmewpUn/LwSUBPkvgjzkQyTDbAFd2Pm5i:xYX+EMU/zobY39qoowSUBPkzQyzAsGTk

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oftupet.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\evbupes.exe"	oftupet.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\imnoosef-amix.exe"	oftupet.exe

Executes dropped EXE 2 IoCs

Processes:

oftupet.exeoftupet.exe

pid process

1892 oftupet.exe
2540 oftupet.exe
Loads dropped DLL 3 IoCs

Processes:

0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exeoftupet.exe

pid process

2292 0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
2292 0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
1892 oftupet.exe

pid	process
2292	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
2292	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
1892	oftupet.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oftupet.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	oftupet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\apdibeam-ouced.dll"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	oftupet.exe

Drops file in System32 directory 9 IoCs

Processes:

oftupet.exe0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\evbupes.exe	oftupet.exe
File created	C:\Windows\SysWOW64\evbupes.exe	oftupet.exe
File created	C:\Windows\SysWOW64\apdibeam-ouced.dll	oftupet.exe
File opened for modification	C:\Windows\SysWOW64\oftupet.exe	oftupet.exe
File opened for modification	C:\Windows\SysWOW64\apdibeam-ouced.dll	oftupet.exe
File opened for modification	C:\Windows\SysWOW64\oftupet.exe	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\oftupet.exe	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\imnoosef-amix.exe	oftupet.exe
File created	C:\Windows\SysWOW64\imnoosef-amix.exe	oftupet.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

oftupet.exeoftupet.exe

pid	process
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
2540	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe
1892	oftupet.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

oftupet.exe

description pid process

Token: SeDebugPrivilege 1892 oftupet.exe

description	pid	process
Token: SeDebugPrivilege	1892	oftupet.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exeoftupet.exe

description	pid	process	target process
PID 2292 wrote to memory of 1892	2292	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 2292 wrote to memory of 1892	2292	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 2292 wrote to memory of 1892	2292	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 2292 wrote to memory of 1892	2292	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 1892 wrote to memory of 2540	1892	oftupet.exe	oftupet.exe
PID 1892 wrote to memory of 2540	1892	oftupet.exe	oftupet.exe
PID 1892 wrote to memory of 2540	1892	oftupet.exe	oftupet.exe
PID 1892 wrote to memory of 2540	1892	oftupet.exe	oftupet.exe
PID 1892 wrote to memory of 420	1892	oftupet.exe	winlogon.exe
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	oftupet.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\SysWOW64\oftupet.exe
"C:\Windows\SysWOW64\oftupet.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\oftupet.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\apdibeam-ouced.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\evbupes.exe
Filesize
72KB

MD5
3be42477f23bd7ecd9a8b747ab41ca1f

SHA1
f7cd8e527eee4768b89b7d65d7c7be34f6427292

SHA256
2728bf89f4d20bee014beff52a7320aefb3f1f5f382ddb7eafa750b3a29086da

SHA512
c864d940b063c682fe87bdb0e157e0c16b644ec8bbad9a5b77256b91509430d12a57a85414688918a3366a143f179e83aff95bbf738d0cd31a5ec5b959172401

Download Submit
C:\Windows\SysWOW64\imnoosef-amix.exe
Filesize
73KB

MD5
36511d4708f9a12995c44693c75bf792

SHA1
0df2162fe0b2ff6bb0c8fd44d96a8d4656f8aa54

SHA256
10209ebbe0d80d670fcef2f8f57871f6491b24f48c23855bd664ba52517f3a30

SHA512
9d51a0df5dc9ca3489a0d847154d8534b3fbb0c006d0310d2083923a8ba526319c3de66eb868478c26bb3d47d17f7ead8aa37f8fbb19b51a5c4551ec138791f1

Download Submit
\Windows\SysWOW64\oftupet.exe
Filesize
70KB

MD5
06290472ac7ccc39587d5bcb838e9ac0

SHA1
4fbeb3e697babe081d9a6f661ad0c213bc006990

SHA256
7fe813ef10c5d8fc61f5153f5dd0b28022f697991427636c81e10d11e19f2032

SHA512
4228f94a61611314e0a5e537b2d020b70101c67ae373e35ce4ab2f1a523090dee65a2da467d97f4c0d3dd72dd764250287af59905f9b6e9eed56040b5201f6e4

Download Submit
memory/1892-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2292-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2540-51-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads