39d1253baba4a7ba3c85ba361257b0a0768eb65b561b6c337135f8acc66bf61b

General

Target

0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
Size

135KB
MD5

0d0065fac9447c4bbe078e796b4d3ff0
SHA1

f2f87c3d4567cef59e83b728834ad58ffeb82939
SHA256

39d1253baba4a7ba3c85ba361257b0a0768eb65b561b6c337135f8acc66bf61b
SHA512

8020dc6fc790f6d346ad43b484e432a8151a6f4ebe82afe5f62a3e8940df21e5b71ef76ace0e62b8da742dbe8a6c993f97899bc082c4d8f6e9c6843a848a3e38
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVWI:UVqoCl/YgjxEufVU0TbTyDDalQI

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2280 explorer.exe
848 spoolsv.exe
2732 svchost.exe
2652 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

pid process

2164 0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2280 explorer.exe
848 spoolsv.exe
2732 svchost.exe

pid	process
2280	explorer.exe
848	spoolsv.exe
2732	svchost.exe
2652	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

explorer.exe0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2552 schtasks.exe
2004 schtasks.exe
2888 schtasks.exe

pid	process
2552	schtasks.exe
2004	schtasks.exe
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2732	svchost.exe
2280	explorer.exe
2280	explorer.exe
2280	explorer.exe
2732	svchost.exe
2732	svchost.exe
2280	explorer.exe
2732	svchost.exe
2280	explorer.exe
2732	svchost.exe
2280	explorer.exe
2732	svchost.exe
2280	explorer.exe
2732	svchost.exe
2280	explorer.exe
2732	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2280 explorer.exe
2732 svchost.exe

pid	process
2280	explorer.exe
2732	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
2280	explorer.exe
2280	explorer.exe
848	spoolsv.exe
848	spoolsv.exe
2732	svchost.exe
2732	svchost.exe
2652	spoolsv.exe
2652	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2164 wrote to memory of 2280	2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe	explorer.exe
PID 2164 wrote to memory of 2280	2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe	explorer.exe
PID 2164 wrote to memory of 2280	2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe	explorer.exe
PID 2164 wrote to memory of 2280	2164	0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe	explorer.exe
PID 2280 wrote to memory of 848	2280	explorer.exe	spoolsv.exe
PID 2280 wrote to memory of 848	2280	explorer.exe	spoolsv.exe
PID 2280 wrote to memory of 848	2280	explorer.exe	spoolsv.exe
PID 2280 wrote to memory of 848	2280	explorer.exe	spoolsv.exe
PID 848 wrote to memory of 2732	848	spoolsv.exe	svchost.exe
PID 848 wrote to memory of 2732	848	spoolsv.exe	svchost.exe
PID 848 wrote to memory of 2732	848	spoolsv.exe	svchost.exe
PID 848 wrote to memory of 2732	848	spoolsv.exe	svchost.exe
PID 2732 wrote to memory of 2652	2732	svchost.exe	spoolsv.exe
PID 2732 wrote to memory of 2652	2732	svchost.exe	spoolsv.exe
PID 2732 wrote to memory of 2652	2732	svchost.exe	spoolsv.exe
PID 2732 wrote to memory of 2652	2732	svchost.exe	spoolsv.exe
PID 2280 wrote to memory of 2688	2280	explorer.exe	Explorer.exe
PID 2280 wrote to memory of 2688	2280	explorer.exe	Explorer.exe
PID 2280 wrote to memory of 2688	2280	explorer.exe	Explorer.exe
PID 2280 wrote to memory of 2688	2280	explorer.exe	Explorer.exe
PID 2732 wrote to memory of 2552	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2552	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2552	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2552	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2004	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2004	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2004	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2004	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2888	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2888	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2888	2732	svchost.exe	schtasks.exe
PID 2732 wrote to memory of 2888	2732	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:53 /f
5⤵
- Creates scheduled task(s)
PID:2552

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:54 /f
5⤵
- Creates scheduled task(s)
PID:2004

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:55 /f
5⤵
- Creates scheduled task(s)
PID:2888

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
3⤵
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
102eee7ecd7f958cd955a47dfb40965c

SHA1
78c1250a0adddc416bd235446437bba836638583

SHA256
e8b29468443c48dc6b15c37e2d745d0b686804a3cfc0e6d0d774d1c8a235d82e

SHA512
e1ae128dd0d6f600e60452c08ae5d7df300072e6b481f963ee0e9c4e2198909fc9f04b828f7584fa1a4f404204db9c1d7e4205037b20bb25f75b892573d7ed61

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
f0d219eece9b69fa94509b92ca0d6641

SHA1
cb3dbc538ad53f4f21131faded958c84249718ee

SHA256
c7a02dd8bf0444587e0c822d54bb979c766e167b7d549ec6006bcf7f31626216

SHA512
238134b3569678ef3007cf6bb6537fcc40b8f71a9cd7b3cc0e2e42b2b0336b646e27b59262eb81fdabdec452cc67ea7d4a918dc01270775936778aa21c4cb1ac

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
a43897a9369a01624162b9ce7ad73355

SHA1
b97db5c6227067053670ae6e5af234b211eaafa6

SHA256
d24ca33722c3e346af88885ffb53ae9db71214194a10b1b67c2cb0418872c2fc

SHA512
68658bb36f07e566c1329f030456d188bc980bfe155582f8920c9a675297081d136a384460124ec57723f9f8e3e27d4802f779ffd6dc7979e2e90907f0050e16

Download Submit
memory/848-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2164-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2164-10-0x0000000000380000-0x000000000039F000-memory.dmp

Filesize
124KB

Download
memory/2164-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2652-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2732-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2732-37-0x0000000000270000-0x000000000028F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads