db9408e88931ad40814bd20ad689c773555d5f68f3798cf7ccf8f2bd112c01c3

General

Target

4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
Size

135KB
MD5

4a64ac48be953daf401e076c80d08a70
SHA1

a1414801920a264e150966ddca6d564ee1270c49
SHA256

db9408e88931ad40814bd20ad689c773555d5f68f3798cf7ccf8f2bd112c01c3
SHA512

79e418593da5144ea47181a807f21cec968fefc091666d6f57ca6cd7bd8c2735286ea8ae8a5ab3d825b4f459f0ee325c91b7860b25b134e970a9e9bb81c43a04
SSDEEP

1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXF:UVqoCl/YgjxEufVU0TbTyDDalRF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

1944 explorer.exe
2540 spoolsv.exe
2652 svchost.exe
2600 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

pid process

2380 4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
1944 explorer.exe
2540 spoolsv.exe
2652 svchost.exe

pid	process
1944	explorer.exe
2540	spoolsv.exe
2652	svchost.exe
2600	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2636 schtasks.exe
872 schtasks.exe
2368 schtasks.exe

pid	process
2636	schtasks.exe
872	schtasks.exe
2368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
1944	explorer.exe
1944	explorer.exe
1944	explorer.exe
2652	svchost.exe
2652	svchost.exe
1944	explorer.exe
2652	svchost.exe
1944	explorer.exe
2652	svchost.exe
1944	explorer.exe
2652	svchost.exe
1944	explorer.exe
2652	svchost.exe
1944	explorer.exe
2652	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

1944 explorer.exe
2652 svchost.exe

pid	process
1944	explorer.exe
2652	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
1944	explorer.exe
1944	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2652	svchost.exe
2652	svchost.exe
2600	spoolsv.exe
2600	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2380 wrote to memory of 1944	2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe	explorer.exe
PID 2380 wrote to memory of 1944	2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe	explorer.exe
PID 2380 wrote to memory of 1944	2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe	explorer.exe
PID 2380 wrote to memory of 1944	2380	4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe	explorer.exe
PID 1944 wrote to memory of 2540	1944	explorer.exe	spoolsv.exe
PID 1944 wrote to memory of 2540	1944	explorer.exe	spoolsv.exe
PID 1944 wrote to memory of 2540	1944	explorer.exe	spoolsv.exe
PID 1944 wrote to memory of 2540	1944	explorer.exe	spoolsv.exe
PID 2540 wrote to memory of 2652	2540	spoolsv.exe	svchost.exe
PID 2540 wrote to memory of 2652	2540	spoolsv.exe	svchost.exe
PID 2540 wrote to memory of 2652	2540	spoolsv.exe	svchost.exe
PID 2540 wrote to memory of 2652	2540	spoolsv.exe	svchost.exe
PID 2652 wrote to memory of 2600	2652	svchost.exe	spoolsv.exe
PID 2652 wrote to memory of 2600	2652	svchost.exe	spoolsv.exe
PID 2652 wrote to memory of 2600	2652	svchost.exe	spoolsv.exe
PID 2652 wrote to memory of 2600	2652	svchost.exe	spoolsv.exe
PID 1944 wrote to memory of 2736	1944	explorer.exe	Explorer.exe
PID 1944 wrote to memory of 2736	1944	explorer.exe	Explorer.exe
PID 1944 wrote to memory of 2736	1944	explorer.exe	Explorer.exe
PID 1944 wrote to memory of 2736	1944	explorer.exe	Explorer.exe
PID 2652 wrote to memory of 2636	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2636	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2636	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2636	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 872	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 872	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 872	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 872	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2368	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2368	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2368	2652	svchost.exe	schtasks.exe
PID 2652 wrote to memory of 2368	2652	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a64ac48be953daf401e076c80d08a70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1944
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2652
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2600
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:20 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2636
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:21 /f
        5⤵
        Creates scheduled task(s)
        
        PID:872
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:22 /f
        5⤵
        Creates scheduled task(s)
        
        PID:2368
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
a8f1387c0e0de620f941eedda6a9c85d

SHA1
60cf4f61a59c937fa5c8d589e118527c80f06747

SHA256
7b76644f8d7a7c03212d3ddbc3796a6bc14f07ba6dd8fd5b82b5d595745a78ea

SHA512
5425c42c98700aa0968a08d06b398e8c7cc0449dedfcd55275bab5bdc40beb1064b9dbdfd7715d1e20de5b9abc668ee6ca1c5344c6bfe1d6216ff884216e6e4f

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
fc87c62d4f8a71ec84b827bea832dd97

SHA1
7555e464ef56b9b9b44bfd65f474f703a738b9f2

SHA256
dc8ef7c6a5c5a08ca6eeb1a82a0e84ed33369557daddf2494ac742686245eaae

SHA512
a01671ef2980461e8928b46647bc2fba36f860bab784ad4a580336983bbf138feaae10dae206409bc2b318f99e1d9f12cd2303a1103c4b2ebf1ea30dfa5f2a1a

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
e18727e33d52024eda5052d4d2f5cb48

SHA1
aeb3d46f3ea2aa2942334ea36f4a37e2d578e1c6

SHA256
c0a24419fa5038a7e282b9762f9e8294ca428085d2a476de4798fe4bae21acbb

SHA512
69250bbb58ea0b341e3f2228399f213c0de15065ebc3dbe97f36316d4620c0aa261588131d1e96b5caf789740212251f9a67df01f9466bbee45c4869a4a06a43

Download Submit
memory/1944-19-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/2380-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2380-8-0x00000000005C0000-0x00000000005DF000-memory.dmp

Filesize
124KB

Download
memory/2380-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2540-30-0x00000000003B0000-0x00000000003CF000-memory.dmp

Filesize
124KB

Download
memory/2540-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2600-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2652-38-0x00000000002F0000-0x000000000030F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads