6dcb6fa7575ad1c8d4833afe40e8a4ef219f62bd25b4162598beb1cc7fb3e5d8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
Size

72KB
MD5

54e8b926d68cfedfb372db8bfc03c2b0
SHA1

98bac1b7d2c4c33cd5a406bafe2c33e42eac8fcb
SHA256

6dcb6fa7575ad1c8d4833afe40e8a4ef219f62bd25b4162598beb1cc7fb3e5d8
SHA512

3817d3a66f0adc2d07bdbbdd24e5972bfc5bb9cb41d4b8cc08b6d9c5affc37849ba1190abb41f1e9c19dae8fd2feb6a74f64f8454f74b9d87dd88ec65e617bc6
SSDEEP

1536:xvR9KzUD5X66zFOa2INL0U/zDDiGPsMI7MPeDm5YOY:lKzAXXzFt2INJ/4MPuqYr

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	lnimoat.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\StubPath = "C:\\Windows\\system32\\imkexoat-ucid.exe"	lnimoat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\IsInstalled = "1"	lnimoat.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eaxbonev.exe"	lnimoat.exe

Executes dropped EXE 2 IoCs

pid	Process
3172	lnimoat.exe
1592	lnimoat.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	lnimoat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	lnimoat.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\bvotes-ouxom.dll"	lnimoat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	lnimoat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	lnimoat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	lnimoat.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\lnimoat.exe	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\imkexoat-ucid.exe	lnimoat.exe
File opened for modification	C:\Windows\SysWOW64\bvotes-ouxom.dll	lnimoat.exe
File created	C:\Windows\SysWOW64\bvotes-ouxom.dll	lnimoat.exe
File opened for modification	C:\Windows\SysWOW64\lnimoat.exe	lnimoat.exe
File created	C:\Windows\SysWOW64\lnimoat.exe	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\eaxbonev.exe	lnimoat.exe
File created	C:\Windows\SysWOW64\eaxbonev.exe	lnimoat.exe
File created	C:\Windows\SysWOW64\imkexoat-ucid.exe	lnimoat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
1592	lnimoat.exe
1592	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe
3172	lnimoat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	lnimoat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3172	2256	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	83
PID 2256 wrote to memory of 3172	2256	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	83
PID 2256 wrote to memory of 3172	2256	54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe	83
PID 3172 wrote to memory of 1592	3172	lnimoat.exe	84
PID 3172 wrote to memory of 1592	3172	lnimoat.exe	84
PID 3172 wrote to memory of 1592	3172	lnimoat.exe	84
PID 3172 wrote to memory of 620	3172	lnimoat.exe	5
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56
PID 3172 wrote to memory of 3356	3172	lnimoat.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3356
- C:\Users\Admin\AppData\Local\Temp\54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\54e8b926d68cfedfb372db8bfc03c2b0_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\lnimoat.exe
    "C:\Windows\SysWOW64\lnimoat.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\lnimoat.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bvotes-ouxom.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\eaxbonev.exe

Filesize
73KB

MD5
611be5ce0d80f79c3c164884a76d62e9

SHA1
122e49a4ce2b3668a46de6f9b749aaa68c1a0023

SHA256
1432d12ceeb82c0c7e9acd29c93c81e09260e027678e91fb84e6cd950c3347e7

SHA512
2b06627a2d23f4cfa5e88392623818933a6dd7fdac281d2b82f47588a93d0e9a410a248419d702648f45ed49d5d189efc499d4cec25498f6ca1a398054116277

Download Submit
C:\Windows\SysWOW64\imkexoat-ucid.exe

Filesize
72KB

MD5
6efbb72336f1a7628d98887ef9a337c4

SHA1
3e5c380a1b5ffa3ccb7d29394bfde796e3577957

SHA256
23425048fbb770b4aee165c96e57500adab47ccec96133d970f704adebad2444

SHA512
5dcc70f1b91d65f7e830e1af676a6afe6a1a2248ea2ac5a5a0dc80ce10f20f7f13af9e8223f73c28c0bac7905e5654e15ee525b0a97a5c08e99b2f3d41835360

Download Submit
C:\Windows\SysWOW64\lnimoat.exe

Filesize
70KB

MD5
a535b575222fff43ddd0eb929c5b70a7

SHA1
24a2b2162abd56c99534d02663fc4395d901c18e

SHA256
670edfdccb5e8acb1294f9161569d10862925e1df21af320075e441479b12d48

SHA512
5b666a761883be14456e7771482c308d3fe71c53e351a664344ed640635b1881ed69242a1c31787a5a2883b4f722fb8e88fcbb7db919461a1c62832c62134548

Download Submit
memory/1592-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2256-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3172-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download