8c9377033e8bf44f8b296897ff9f65741257ab338a572b816da381b589f0ac71

General

Target

4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe
Size

1.9MB
MD5

4e09117175550c67584f2f757d28f290
SHA1

cd13a2a360fa85f5fb715ced44c90a70208bee70
SHA256

8c9377033e8bf44f8b296897ff9f65741257ab338a572b816da381b589f0ac71
SHA512

a20f62d2db83ac05f93e366043ef0f64f527e39486dfdfce688a158f0ab01c55a26b917c624ae084c7927be3d2441e55e3e71ac7e25d9afdb849eb1beebdf219
SSDEEP

6144:2BDHmrz4niNy8o3Zp/TWt+g4RQTDUBO8/2vh+ziDV8m56TBac2Guc:wDHmoniNy8L8g4RgoBO8/2vhDX56Tf

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2528 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

DBSever0.EXE

pid process

2868 DBSever0.EXE

pid	process
2528	cmd.exe

pid	process
2868	DBSever0.EXE

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DBSever0.EXE4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WDDBSever0.EXE = "\"C:\\Windows\\DBSever0.EXE\" /Auto"	DBSever0.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDDBSever0.EXE = "\"C:\\Windows\\DBSever0.EXE\" /Auto"	DBSever0.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WDDBSever0.EXE = "\"C:\\Windows\\DBSever0.EXE\" /Auto"	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

Processes:

4e09117175550c67584f2f757d28f290_NeikiAnalytics.exeDBSever0.EXE

description	ioc	process
File opened for modification	C:\Windows\DBSever0.EXE	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe
File created	C:\Windows\DBSever0.EXE	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe
File opened for modification	C:\Windows\DBSever0.KInf	DBSever0.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DBSever0.EXE

description pid process

Token: SeDebugPrivilege 2868 DBSever0.EXE

description	pid	process
Token: SeDebugPrivilege	2868	DBSever0.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe

description	pid	process	target process
PID 2072 wrote to memory of 2868	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	DBSever0.EXE
PID 2072 wrote to memory of 2868	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	DBSever0.EXE
PID 2072 wrote to memory of 2868	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	DBSever0.EXE
PID 2072 wrote to memory of 2868	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	DBSever0.EXE
PID 2072 wrote to memory of 2528	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	cmd.exe
PID 2072 wrote to memory of 2528	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	cmd.exe
PID 2072 wrote to memory of 2528	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	cmd.exe
PID 2072 wrote to memory of 2528	2072	4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4e09117175550c67584f2f757d28f290_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\DBSever0.EXE
C:\Windows\DBSever0.EXE
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Temp0.bat" "
2⤵
- Deletes itself
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Temp0.bat

Filesize
268B

MD5
8252798367e1dabe8c2878a390ea574e

SHA1
7e1a6c2621b2c139d3bc1034abf6a798a71bc200

SHA256
d5a713b79652295deaf13bc546091bd5b48edd313d4df08dfef42c282481f9bd

SHA512
e7026423daf5ac37325f52db56bd6f4c45fc066520486e2798c3482d61870f595ea94bd562edd9dfbe4264c4d9bc061e644c42ffdf252b2e53ab5d6216405afa

Download Submit
C:\Windows\DBSever0.EXE

Filesize
1.9MB

MD5
586aa831bdde7e7da3d476d7e1ad20b6

SHA1
b3be39d333a9fb2f2a76dec4888b7848f12f44e2

SHA256
c9f0f1b36c8d9c11738536bf57948714d62bb45b3586cb580c05be769c48b6d4

SHA512
7bf83d3a03936685286b6391c0fca9bb637891f593642007de517055e16629a4438c79673b70898a25da85ce00fc5231d1f26e1d5faebedb4b97ef74a565598a

Download Submit
memory/2072-13-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2868-15-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2868-17-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2868-20-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2868-23-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2868-26-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads