6dcb6fa7575ad1c8d4833afe40e8a4ef219f62bd25b4162598beb1cc7fb3e5d8

General

Target

54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
Size

72KB
MD5

54e8b926d68cfedfb372db8bfc03c2b0
SHA1

98bac1b7d2c4c33cd5a406bafe2c33e42eac8fcb
SHA256

6dcb6fa7575ad1c8d4833afe40e8a4ef219f62bd25b4162598beb1cc7fb3e5d8
SHA512

3817d3a66f0adc2d07bdbbdd24e5972bfc5bb9cb41d4b8cc08b6d9c5affc37849ba1190abb41f1e9c19dae8fd2feb6a74f64f8454f74b9d87dd88ec65e617bc6
SSDEEP

1536:xvR9KzUD5X66zFOa2INL0U/zDDiGPsMI7MPeDm5YOY:lKzAXXzFt2INJ/4MPuqYr

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

lnimoat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	lnimoat.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lnimoat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\IsInstalled = "1"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\StubPath = "C:\\Windows\\system32\\imkexoat-ucid.exe"	lnimoat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	lnimoat.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lnimoat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eaxbonev.exe"	lnimoat.exe

Executes dropped EXE 2 IoCs

Processes:

lnimoat.exelnimoat.exe

pid process

2992 lnimoat.exe
2060 lnimoat.exe
Loads dropped DLL 3 IoCs

Processes:

54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exelnimoat.exe

pid process

2848 54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
2848 54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
2992 lnimoat.exe

pid	process
2848	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
2848	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
2992	lnimoat.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

lnimoat.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	lnimoat.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

lnimoat.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\bvotes-ouxom.dll"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	lnimoat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	lnimoat.exe

Drops file in System32 directory 9 IoCs

Processes:

lnimoat.exe54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\SysWOW64\eaxbonev.exe	lnimoat.exe
File created	C:\Windows\SysWOW64\imkexoat-ucid.exe	lnimoat.exe
File opened for modification	C:\Windows\SysWOW64\bvotes-ouxom.dll	lnimoat.exe
File created	C:\Windows\SysWOW64\bvotes-ouxom.dll	lnimoat.exe
File opened for modification	C:\Windows\SysWOW64\lnimoat.exe	lnimoat.exe
File opened for modification	C:\Windows\SysWOW64\lnimoat.exe	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\lnimoat.exe	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\eaxbonev.exe	lnimoat.exe
File opened for modification	C:\Windows\SysWOW64\imkexoat-ucid.exe	lnimoat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

lnimoat.exelnimoat.exe

pid	process
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2060	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe
2992	lnimoat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lnimoat.exe

description pid process

Token: SeDebugPrivilege 2992 lnimoat.exe

description	pid	process
Token: SeDebugPrivilege	2992	lnimoat.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exelnimoat.exe

description	pid	process	target process
PID 2848 wrote to memory of 2992	2848	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	lnimoat.exe
PID 2848 wrote to memory of 2992	2848	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	lnimoat.exe
PID 2848 wrote to memory of 2992	2848	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	lnimoat.exe
PID 2848 wrote to memory of 2992	2848	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	lnimoat.exe
PID 2992 wrote to memory of 432	2992	lnimoat.exe	winlogon.exe
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 2060	2992	lnimoat.exe	lnimoat.exe
PID 2992 wrote to memory of 2060	2992	lnimoat.exe	lnimoat.exe
PID 2992 wrote to memory of 2060	2992	lnimoat.exe	lnimoat.exe
PID 2992 wrote to memory of 2060	2992	lnimoat.exe	lnimoat.exe
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE
PID 2992 wrote to memory of 1188	2992	lnimoat.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188

C:\Users\Admin\AppData\Local\Temp\54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\lnimoat.exe
"C:\Windows\SysWOW64\lnimoat.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\lnimoat.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bvotes-ouxom.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\eaxbonev.exe

Filesize
73KB

MD5
ae181d44f4fd01bad5c3eb7ee0dcc0bb

SHA1
fe28d63f580e83187f47f4780b8edadfa8ca13ae

SHA256
879be4175c9cec941f71b87b322c3398fd19afae97e8ca44c16d353582a40d58

SHA512
3600fbde7a792770b8d8f0fcf4405881fe641ee5e433279ab7b69cd5167cfd18c4caff6d8e5a5a04aa3b0eb4e1bd784dc700c06af29e8763f4a7e747b85c4877

Download Submit
C:\Windows\SysWOW64\imkexoat-ucid.exe

Filesize
72KB

MD5
ff1a9f185bd6c8c17d8abbf4a8073f37

SHA1
ffeaafb08993989f1480a7be24915a295c46fa64

SHA256
c82db0840d8a0773b179a565d410c2b4cdf96eb5c1ed5c1f8a2c9fec19117fc6

SHA512
57cb240604744891b1a1e26f1f2774727921e19e1f81d0ce3389c4ce179265a712bfa5734a7230164ce15f14df62c985bf8aacd141f12023906108ae35f6c313

Download Submit
\Windows\SysWOW64\lnimoat.exe

Filesize
70KB

MD5
a535b575222fff43ddd0eb929c5b70a7

SHA1
24a2b2162abd56c99534d02663fc4395d901c18e

SHA256
670edfdccb5e8acb1294f9161569d10862925e1df21af320075e441479b12d48

SHA512
5b666a761883be14456e7771482c308d3fe71c53e351a664344ed640635b1881ed69242a1c31787a5a2883b4f722fb8e88fcbb7db919461a1c62832c62134548

Download Submit
memory/2060-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2848-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2992-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads