Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
22-05-2024 22:56
General
-
Target
521f845505ad556fdb6e4bf1287530f0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
521f845505ad556fdb6e4bf1287530f0
-
SHA1
967c3d7da68c5b426d9b7a77bbd20ead3e581eae
-
SHA256
7b8de8aeb030d78144da151db0114d72207c088d1310939e17200d751c710323
-
SHA512
30121734cc9383cc512196daba79912f545d24653ace120c229221bc59c275961be3648f3037c1ca47556f34b520891a77710692a1772b666ba5bbdbd8e9348b
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI3:J8dfX7y9DZ+N7eB+tI3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
Executes dropped EXE 12 IoCs
-
Loads dropped DLL 21 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\521f845505ad556fdb6e4bf1287530f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\521f845505ad556fdb6e4bf1287530f0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\521f845505ad556fdb6e4bf1287530f0_NeikiAnalytics.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
97KB
MD54dfaa2bfa939420335a4a7aa3048324e
SHA1a78c7e6b1cc358c44fd029ba3ebdc70373520070
SHA2566e2ecf95ff233f784da95a09737466db48a92e1001e6296a88e2dc8ad8b6fb47
SHA512d24129f96ca2ae4dc9ad1c67d7bebf478bc1ff6d1ef3cf7fccaea28d223affa149a31721559e5a3fc44af9a5a267f364fe36fa20a04a8a2c2ffa1285b7ca2f5a
-
Filesize
97KB
MD5de39d8ee400275a8961ddde6ed39506c
SHA1a14f95c196c4e974b97781190babc3db5ab4d307
SHA25664ccff92adbb5597ef5b7950c3736702d2bd0ddaad71a2c642e0df87707c11fa
SHA5127f807160e4e97ede967b15543ede40ee0c4acb3e2e65e18fdc0bd4feae5d8b3befdff99aeac549dd5ec2df6a9df96223df0ba37a4974274dc528429ada56a220
-
Filesize
97KB
MD5764708a24e303b196dd02b5f9dc5168d
SHA190315ddc423d0ed151e0f9787e23d7c235a3a01c
SHA256c9a7f0650df549d7904d19337e1506070cef083e483987810114a283dd36b867
SHA5125c7e2d2b5d19dd2035df97dc61c7d2cfbbe287bd4cb750c31c6f3c090900a5de9367d129f085816b5e28bec630b61128faa9042a213caf2eaaba1862928c0068
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD56b011e2aecbcfa5822afeb4c1822c964
SHA1c96c49dbfdb723a222178be3a2aab54427aa6129
SHA2563fb2fee173caa673afc0de5bae81a674be5abb7b357572366441fd3d79839b96
SHA512cac416144c390d008ca34dedf1cfe23911710cf32526eed43f1883b063a05e862227ad889feabc83c1d316d44cca518d63a42a93d9494ea618ac4ff7382d54fc
-
Filesize
97KB
MD5ea5823c984eb3cc88d1d8e455c0e46eb
SHA1ffea4a2c7fdb5204b93f9606113fdf62a5f06e47
SHA256da2907ffd70d74d1fdfc84efed035716d026ff5708275046b55814e38d75cb4b
SHA512f03ea47127792ba97df902f5c098ffd4102f4a3f3a9077aad6e62214d6e1caa698c9ab9e55271d55dcfe1b6309fba7ec6dfdaed3821ad07c59e8a889e0dc6045
-
Filesize
97KB
MD533dd832e46c420a19d940421202614a9
SHA1c76ce3d1fa74634a71aeac9387658f4604b62068
SHA2560079808a481bcf35c3aec1534ec0e13ab22bd8b7db5e65abb416a2eee8006521
SHA512e4583e5a327bab431fde24fe0cad2f495bc052c835880e140f08fc98d660e111026a20f3413bab0cee03b4518ebdb0e853b1781ef093f76a9eb72bb60e031e9a
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB