c60f3790018d9dcb3433df7a2928977853635d440a3ba1284873607a1faf8d0d

General

Target

0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
Size

72KB
MD5

0cebffcc508b9c908596fe6233d0b410
SHA1

ecbcf8bcca3e54ecde58a1ac6b19e2e15b1fb113
SHA256

c60f3790018d9dcb3433df7a2928977853635d440a3ba1284873607a1faf8d0d
SHA512

fa80a4729c1b2de9e63e969659d0eeac75efe554579e5a234260824b9a29a7a0d7cfbcad6d0542322ea6426b88c01fc99524b13f44abbc7cc36c6b596931f692
SSDEEP

768:x/nGhX+OZMUpVzJKsMIWqH3N7GLCMa7kmewpUn/LwSUBPkvgjzkQyTDbAFd2Pm5i:xYX+EMU/zobY39qoowSUBPkzQyzAsGTk

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oftupet.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\IsInstalled = "1"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\StubPath = "C:\\Windows\\system32\\evbupes.exe"	oftupet.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\imnoosef-amix.exe"	oftupet.exe

Executes dropped EXE 2 IoCs

Processes:

oftupet.exeoftupet.exe

pid process

116 oftupet.exe
1968 oftupet.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oftupet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oftupet.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

oftupet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	oftupet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\apdibeam-ouced.dll"	oftupet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	oftupet.exe

Drops file in System32 directory 9 IoCs

Processes:

0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exeoftupet.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\oftupet.exe	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\evbupes.exe	oftupet.exe
File created	C:\Windows\SysWOW64\apdibeam-ouced.dll	oftupet.exe
File created	C:\Windows\SysWOW64\oftupet.exe	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\imnoosef-amix.exe	oftupet.exe
File created	C:\Windows\SysWOW64\imnoosef-amix.exe	oftupet.exe
File opened for modification	C:\Windows\SysWOW64\evbupes.exe	oftupet.exe
File opened for modification	C:\Windows\SysWOW64\apdibeam-ouced.dll	oftupet.exe
File opened for modification	C:\Windows\SysWOW64\oftupet.exe	oftupet.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

oftupet.exeoftupet.exe

pid	process
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
1968	oftupet.exe
1968	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe
116	oftupet.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

oftupet.exe

description pid process

Token: SeDebugPrivilege 116 oftupet.exe

description	pid	process
Token: SeDebugPrivilege	116	oftupet.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exeoftupet.exe

description	pid	process	target process
PID 1832 wrote to memory of 116	1832	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 1832 wrote to memory of 116	1832	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 1832 wrote to memory of 116	1832	0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe	oftupet.exe
PID 116 wrote to memory of 624	116	oftupet.exe	winlogon.exe
PID 116 wrote to memory of 1968	116	oftupet.exe	oftupet.exe
PID 116 wrote to memory of 1968	116	oftupet.exe	oftupet.exe
PID 116 wrote to memory of 1968	116	oftupet.exe	oftupet.exe
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE
PID 116 wrote to memory of 3524	116	oftupet.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0cebffcc508b9c908596fe6233d0b410_NeikiAnalytics.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\oftupet.exe
"C:\Windows\SysWOW64\oftupet.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\oftupet.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\apdibeam-ouced.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\evbupes.exe

Filesize
72KB

MD5
b881840571dd4aeaa4e72f5775211029

SHA1
ba3c9f711b4e50c18cc6bdd4e9880a0e16f6ff93

SHA256
3b01b0514d3e906809dd9d13c5a919b09e6e1b1f3256663ad9322c237e0c3561

SHA512
c59b5dd07acbf4b4266e908bc654a7469b3e84445e5c53a395471e2e546a46ec760fddc2f64c89b81794853d6b203cb9283e2aeb1f87e75b39305d4985577a41

Download Submit
C:\Windows\SysWOW64\imnoosef-amix.exe

Filesize
73KB

MD5
0c2670337a4cbc3aa054a07bd37bca3b

SHA1
4fc26272d2bf211abf617755d6fdb7d0206f6057

SHA256
0912e72d351d024651293c5dbedc7f888547f20fa248661a5b1e1eaf554040cd

SHA512
4a9da1cd13be0ffd9c1e7bb043a780593ae24e9aea31eeb2db6a666dee039a4645103a2dca2dfa7b430c4b4f4f03b55a99afeaca152c951f252b980888c31ee2

Download Submit
C:\Windows\SysWOW64\oftupet.exe

Filesize
70KB

MD5
06290472ac7ccc39587d5bcb838e9ac0

SHA1
4fbeb3e697babe081d9a6f661ad0c213bc006990

SHA256
7fe813ef10c5d8fc61f5153f5dd0b28022f697991427636c81e10d11e19f2032

SHA512
4228f94a61611314e0a5e537b2d020b70101c67ae373e35ce4ab2f1a523090dee65a2da467d97f4c0d3dd72dd764250287af59905f9b6e9eed56040b5201f6e4

Download Submit
memory/116-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1832-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1968-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads