Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe
-
Size
379KB
-
MD5
5702def7a9c446eb849d96593919eb60
-
SHA1
0664f4fe9fcd6694f7ef08db5d808f13e481ccff
-
SHA256
a1db0875197c5e7f9a82e06a501dcc3601fe896db6b60b32f2879fb62d37871f
-
SHA512
db431d65d12439910363bda311cc0880e5efeeb2f253d04c0b94555580b6c69fb615bc9ca5cf2a902b1009153e8b63845cba7ef89448ef3476d71a3a30f5a27b
-
SSDEEP
6144:XLZ/JdWKonbQAGBCTmpUi65QHtppS07Ga9u:1/JybQLBCTmpI5eN7j9u
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3120 Logo1_.exe 2688 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe File created C:\Windows\vDll.dll Logo1_.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe 3120 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 224 wrote to memory of 4820 224 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe 83 PID 224 wrote to memory of 4820 224 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe 83 PID 224 wrote to memory of 4820 224 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe 83 PID 224 wrote to memory of 3120 224 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe 84 PID 224 wrote to memory of 3120 224 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe 84 PID 224 wrote to memory of 3120 224 5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe 84 PID 3120 wrote to memory of 896 3120 Logo1_.exe 85 PID 3120 wrote to memory of 896 3120 Logo1_.exe 85 PID 3120 wrote to memory of 896 3120 Logo1_.exe 85 PID 896 wrote to memory of 4424 896 net.exe 87 PID 896 wrote to memory of 4424 896 net.exe 87 PID 896 wrote to memory of 4424 896 net.exe 87 PID 4820 wrote to memory of 2688 4820 cmd.exe 89 PID 4820 wrote to memory of 2688 4820 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5498.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5702def7a9c446eb849d96593919eb60_NeikiAnalytics.exe"3⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:2688
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4424
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
750KB
MD5f6d969f9be3a87bcd2d2467adb433e83
SHA1cb932fdb2d8b1deace177efd15f1db80db6b8b35
SHA256857980b0d07deef9175ccc079ebef1b9a715e23817494e6030fa9f072e0c1430
SHA512f13dfce342cf4f12fce9f3c81de8dfbc81717a9cb2225d14369e1ae949195edccb1ddb8bc3fee027f859f1df2421e46684d03dce8c312475cab5bf9619fae119
-
Filesize
620B
MD5b2589037df9da7d55db84dff28189684
SHA15370c76a1ce50b2009f68ca9b287c8e1bf477d72
SHA256b7a2d06743d1a597b77843c52d2f24730e92c6dd134b7ed9d2144fc6b1d32dd0
SHA5125fc85600407c4bd76451fbf7e1f67a69fc90dad66f2c315087c0080094349796110636cb8ecfccbe7bccd876e2deacd635c0da4d203bccf3846767a9e19f5747
-
Filesize
313KB
MD57a8a90ffb24d64c19f5b6be5b36ead97
SHA14e66f0e0d0a54bae622590513fdcb76d9f4d4f52
SHA25639d6f7e0f2af78c84a2101126626246c20907defd388677edcfe32a64a156fa1
SHA51267fa32b0044e5580745eb954a4c8274bbfc974e736999a98509dcdcdb1b88ad4065b913f1afac712c761c27f50db03da289a53f4e39e616065868a68a3c9a878
-
Filesize
66KB
MD5550503a142f3798c6c8b1d0b83895c4f
SHA158ea3b77e0f8f27e81f2d94d99e91e061045956e
SHA25673b8921942d0155f78cf51488f0f4f88af66c853d57c23263f3e4fdf7bfcc58e
SHA512ef14a1640d8fcaf977def32c8d618013bca1c76527313542c88f78bbd2de67843f0624e2fa0e1283c897a074a7bedb91bc6d891616a86f50f56811022bd405da