Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
21-05-2024 20:51
General
-
Target
0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe
-
Size
135KB
-
MD5
0d0065fac9447c4bbe078e796b4d3ff0
-
SHA1
f2f87c3d4567cef59e83b728834ad58ffeb82939
-
SHA256
39d1253baba4a7ba3c85ba361257b0a0768eb65b561b6c337135f8acc66bf61b
-
SHA512
8020dc6fc790f6d346ad43b484e432a8151a6f4ebe82afe5f62a3e8940df21e5b71ef76ace0e62b8da742dbe8a6c993f97899bc082c4d8f6e9c6843a848a3e38
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVWI:UVqoCl/YgjxEufVU0TbTyDDalQI
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d0065fac9447c4bbe078e796b4d3ff0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5096 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD586553a6a2dc76559a52cec57176bb106
SHA1bf15eba6a8cc3e147709c6f2734fff04225bc569
SHA256368293e09ae5969d2c7c5fd8a545aee77c8efd0a023f693a5755f34675c95ff1
SHA512ad9e774e1693123d4927e51a014e58da365b2e38f4ff087c31b4edbd5292b4ce4281d7307e9243fd2622375d837f06bfc11daa4c0de91a8b787b727e4988d41d
-
Filesize
135KB
MD523db51e8522024274b12545d96837ab6
SHA1d6d1f759c5f92ea13b25e876f2c82043e4e2febd
SHA256732a0d02e0911a26b60f9699a96e5f23d52e7193f9d94084b37a0478234af17e
SHA5122018ba807d2072a6b3521ceed09ad9f4c2df6d24e1ec0e4a3436c9110d143cd2632acdc636170663448d99ad5954a7b32175fe3780a425aa5a72ae170b57f269
-
Filesize
135KB
MD5871434eae7e6e45b82678c31ab1e4caa
SHA11ae2c35ef9117c670a2624ee69cf1e3d7c8e5ae0
SHA25691e6d07ffe48c79e77a27d50700ed7be472a121ed9ce8142e79f178011af145a
SHA512998b4b5217ef56a2cfd6c1a7e72557935990ae9c4c74248067063e407f6e90fd4a09f9814d87d636b176dc840a3b12046a2bfa1d3b16e057230650d886623f43
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB