120e782f739d879ee39f8925775488743ba53d41bafc0a9f71cdbf34ef725446

General

Target

4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe
Size

70KB
MD5

4454b2d4cf885a814d5e1ab2cb99f3b0
SHA1

3a9d98cf94e92702b7d625ddd9c28cf778aa0fd7
SHA256

120e782f739d879ee39f8925775488743ba53d41bafc0a9f71cdbf34ef725446
SHA512

3dba64b75070f8a3e5433ee26c2e76b489a309a9394d6bcd536214a2db717be28193e51e198fd273c28ee4df4837f54435aa06d0aeb3786165cbd5c650c3c537
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8DTz:Olg35GTslA5t3/w8nz

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ovhekuv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ovhekuv.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ovhekuv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\IsInstalled = "1"	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\StubPath = "C:\\Windows\\system32\\osgapoad-asoas.exe"	ovhekuv.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ovhekuv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ochootoah.exe"	ovhekuv.exe

Executes dropped EXE 2 IoCs

Processes:

ovhekuv.exeovhekuv.exe

pid process

232 ovhekuv.exe
2168 ovhekuv.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

ovhekuv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ovhekuv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ovhekuv.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ovhekuv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ovhekuv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oulvoatac.dll"	ovhekuv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ovhekuv.exe

Drops file in System32 directory 9 IoCs

Processes:

4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exeovhekuv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ovhekuv.exe	4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\ovhekuv.exe	4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\ochootoah.exe	ovhekuv.exe
File opened for modification	C:\Windows\SysWOW64\osgapoad-asoas.exe	ovhekuv.exe
File created	C:\Windows\SysWOW64\osgapoad-asoas.exe	ovhekuv.exe
File created	C:\Windows\SysWOW64\oulvoatac.dll	ovhekuv.exe
File opened for modification	C:\Windows\SysWOW64\ochootoah.exe	ovhekuv.exe
File opened for modification	C:\Windows\SysWOW64\oulvoatac.dll	ovhekuv.exe
File opened for modification	C:\Windows\SysWOW64\ovhekuv.exe	ovhekuv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ovhekuv.exeovhekuv.exe

pid	process
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
2168	ovhekuv.exe
2168	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe
232	ovhekuv.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exeovhekuv.exe

description pid process

Token: SeDebugPrivilege 1096 4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe
Token: SeDebugPrivilege 232 ovhekuv.exe

description	pid	process
Token: SeDebugPrivilege	1096	4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	232	ovhekuv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exeovhekuv.exe

description	pid	process	target process
PID 1096 wrote to memory of 232	1096	4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe	ovhekuv.exe
PID 1096 wrote to memory of 232	1096	4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe	ovhekuv.exe
PID 1096 wrote to memory of 232	1096	4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe	ovhekuv.exe
PID 232 wrote to memory of 616	232	ovhekuv.exe	winlogon.exe
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 2168	232	ovhekuv.exe	ovhekuv.exe
PID 232 wrote to memory of 2168	232	ovhekuv.exe	ovhekuv.exe
PID 232 wrote to memory of 2168	232	ovhekuv.exe	ovhekuv.exe
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE
PID 232 wrote to memory of 3500	232	ovhekuv.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3500
- C:\Users\Admin\AppData\Local\Temp\4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\4454b2d4cf885a814d5e1ab2cb99f3b0_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\ovhekuv.exe
    "C:\Windows\system32\ovhekuv.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\SysWOW64\ovhekuv.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ochootoah.exe

Filesize
73KB

MD5
7d29b2975c1111e44398fca39d6d9687

SHA1
83d7102f51cabfb1b7b17dbe30ce4121525c7d76

SHA256
379f209dab2c085d5b8a0257957205e273134d060955e87a2d36c39805be07ed

SHA512
0c76df758f036e1d06adf3a70debdea7a09d36c8c8ddd63f6a089aace2ff6cf42d69b7a4b772139e734f8bbc01be2165c198e9399c5d0b75c3a6a80afb85a461

Download Submit
C:\Windows\SysWOW64\osgapoad-asoas.exe

Filesize
72KB

MD5
fe52a2216ba026407ca3f96eeedf47c2

SHA1
b6db1fc24e2983f31628c6bf450aa5766d43fa7a

SHA256
71ddd86a7c4ec0ef726c0ca8e2215a584c18b69588bbbc1fff2826dd781c0e44

SHA512
038a7539d6b66bc7caacc8730521c1ba1096f16b5b793aa36d71699010d155af9ce8eda431f69f0473abb6e9c82f2095723f40689581c5fcb76b4b851a03bb4e

Download Submit
C:\Windows\SysWOW64\oulvoatac.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ovhekuv.exe

Filesize
70KB

MD5
4454b2d4cf885a814d5e1ab2cb99f3b0

SHA1
3a9d98cf94e92702b7d625ddd9c28cf778aa0fd7

SHA256
120e782f739d879ee39f8925775488743ba53d41bafc0a9f71cdbf34ef725446

SHA512
3dba64b75070f8a3e5433ee26c2e76b489a309a9394d6bcd536214a2db717be28193e51e198fd273c28ee4df4837f54435aa06d0aeb3786165cbd5c650c3c537

Download Submit
memory/232-49-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1096-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads