eea70a38a9fc3f8dcc5420ba6f71ac14059c24ccc284bde3431de961da4394fb

General

Target

439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
Size

135KB
MD5

439635d258fe1250bada12b433d1b190
SHA1

afab2df40c6691deb21bef31b98ebbe655880e22
SHA256

eea70a38a9fc3f8dcc5420ba6f71ac14059c24ccc284bde3431de961da4394fb
SHA512

d5e04526b36a86d15c09c52171f1775ff488c2f8377a9fd72fe68efc02b8ce0dbd8dffcb1a185e240c358403c9f1a287f8300cf9d7655b1eb94903b82d386f60
SSDEEP

1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVwl:4VqoCl/YgjxEufVU0TbTyDDalul

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2784 explorer.exe
2472 spoolsv.exe
2664 svchost.exe
2796 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

439635d258fe1250bada12b433d1b190_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

pid process

2892 439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2784 explorer.exe
2472 spoolsv.exe
2664 svchost.exe

pid	process
2784	explorer.exe
2472	spoolsv.exe
2664	svchost.exe
2796	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

439635d258fe1250bada12b433d1b190_NeikiAnalytics.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2776 schtasks.exe
1932 schtasks.exe
2136 schtasks.exe

pid	process
2776	schtasks.exe
1932	schtasks.exe
2136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

439635d258fe1250bada12b433d1b190_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2664	svchost.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2664	svchost.exe
2664	svchost.exe
2784	explorer.exe
2664	svchost.exe
2784	explorer.exe
2664	svchost.exe
2784	explorer.exe
2664	svchost.exe
2784	explorer.exe
2664	svchost.exe
2784	explorer.exe
2664	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exeexplorer.exe

pid process

2664 svchost.exe
2784 explorer.exe

pid	process
2664	svchost.exe
2784	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

439635d258fe1250bada12b433d1b190_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
2784	explorer.exe
2784	explorer.exe
2472	spoolsv.exe
2472	spoolsv.exe
2664	svchost.exe
2664	svchost.exe
2796	spoolsv.exe
2796	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

439635d258fe1250bada12b433d1b190_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2892 wrote to memory of 2784	2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe	explorer.exe
PID 2892 wrote to memory of 2784	2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe	explorer.exe
PID 2892 wrote to memory of 2784	2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe	explorer.exe
PID 2892 wrote to memory of 2784	2892	439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe	explorer.exe
PID 2784 wrote to memory of 2472	2784	explorer.exe	spoolsv.exe
PID 2784 wrote to memory of 2472	2784	explorer.exe	spoolsv.exe
PID 2784 wrote to memory of 2472	2784	explorer.exe	spoolsv.exe
PID 2784 wrote to memory of 2472	2784	explorer.exe	spoolsv.exe
PID 2472 wrote to memory of 2664	2472	spoolsv.exe	svchost.exe
PID 2472 wrote to memory of 2664	2472	spoolsv.exe	svchost.exe
PID 2472 wrote to memory of 2664	2472	spoolsv.exe	svchost.exe
PID 2472 wrote to memory of 2664	2472	spoolsv.exe	svchost.exe
PID 2664 wrote to memory of 2796	2664	svchost.exe	spoolsv.exe
PID 2664 wrote to memory of 2796	2664	svchost.exe	spoolsv.exe
PID 2664 wrote to memory of 2796	2664	svchost.exe	spoolsv.exe
PID 2664 wrote to memory of 2796	2664	svchost.exe	spoolsv.exe
PID 2784 wrote to memory of 2636	2784	explorer.exe	Explorer.exe
PID 2784 wrote to memory of 2636	2784	explorer.exe	Explorer.exe
PID 2784 wrote to memory of 2636	2784	explorer.exe	Explorer.exe
PID 2784 wrote to memory of 2636	2784	explorer.exe	Explorer.exe
PID 2664 wrote to memory of 2776	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2776	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2776	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2776	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 1932	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 1932	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 1932	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 1932	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2136	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2136	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2136	2664	svchost.exe	schtasks.exe
PID 2664 wrote to memory of 2136	2664	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\439635d258fe1250bada12b433d1b190_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:47 /f
5⤵
- Creates scheduled task(s)
PID:2776

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:48 /f
5⤵
- Creates scheduled task(s)
PID:1932

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:49 /f
5⤵
- Creates scheduled task(s)
PID:2136

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
3⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cf876a98d67ee2d1710ad64dee3d90be

SHA1
9d0cfbceb2cf4ad3149b912edd361c7cfea955aa

SHA256
fa0f5f7dbd5a56c7dd7f92d8b134b1607e514399714c663571695712afe7218c

SHA512
d2b336e66df48aff5fca7ce96b6c5c039c30ad40cf5042b5e18c52147d1eaf00ff751ea5dc1948d7ed9176fe59ae951ad686f17c59fb394ad00d9e33c9529ac6

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
1e06e8036da2b7c8707d89b411d62f6a

SHA1
dca17ae83f27f9adb4ed3d0ebe3c429eb93be417

SHA256
ec54ce58d341765a2ca1f3c7f9908448e91dd4906368e31a4a69cfda54ae1a68

SHA512
1604ae8cc87bd82fe1d2d91de57ad1c27fc9ddb8750f3e12f4a55b51ac67b4843a05f0c1f9b68e2c370cb3ff352c48cfb2143c06810a47a54121ba569bc45759

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
b3dcfa2b7b48798b206ce246f52661b6

SHA1
f8a0545e9970ea17dae470e4d2f5c2ba61ca7fe7

SHA256
da6f81dc290cda30a1ce08e52b549da7954fb010507f38b426daf91781e3d020

SHA512
47b796fe0fe2334835bf3f4084794b1b566bd6ab7966d2e12e7270e19538b40d1976934e22cbcb7f7c4bda48efd68e3a3635b6e6eb7964db055248ff999a09be

Download Submit
memory/2472-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2664-37-0x0000000000290000-0x00000000002AF000-memory.dmp

Filesize
124KB

Download
memory/2796-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2892-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2892-10-0x0000000000320000-0x000000000033F000-memory.dmp

Filesize
124KB

Download
memory/2892-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads