9849eb076dea208708947b425dea9d0fd0e9bb49285ac73aa1f98e3465e1ad94

General

Target

590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe
Size

72KB
MD5

590d8f7a38ff6a27505cca0a9e090530
SHA1

fd7ab786d5af02fa507fcf36a240f430da2afdd1
SHA256

9849eb076dea208708947b425dea9d0fd0e9bb49285ac73aa1f98e3465e1ad94
SHA512

6c3e806f2bbce836ab08f577e260d59ed4789a1dd8880065b242d65ef3c58c91f4b6bc5d1e994051a09c43f5890e824ee4b0a719d4657bcdcae42d54d990dd05
SSDEEP

1536:x2zDjFBlS8G13YgsQSGE4zCvrbiCFkaG8pyb2y+/km:QPBBFGtzcJkaxpFAm

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

efgufeas.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	efgufeas.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

efgufeas.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\IsInstalled = "1"	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\StubPath = "C:\\Windows\\system32\\eplatac.exe"	efgufeas.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

efgufeas.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\alrideag-odix.exe"	efgufeas.exe

Executes dropped EXE 2 IoCs

Processes:

efgufeas.exeefgufeas.exe

pid process

3648 efgufeas.exe
3840 efgufeas.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

efgufeas.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	efgufeas.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	efgufeas.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

efgufeas.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eattiteat-ateab.dll"	efgufeas.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	efgufeas.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	efgufeas.exe

Drops file in System32 directory 9 IoCs

Processes:

efgufeas.exe590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\alrideag-odix.exe	efgufeas.exe
File opened for modification	C:\Windows\SysWOW64\eplatac.exe	efgufeas.exe
File opened for modification	C:\Windows\SysWOW64\efgufeas.exe	590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\efgufeas.exe	590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\alrideag-odix.exe	efgufeas.exe
File created	C:\Windows\SysWOW64\eplatac.exe	efgufeas.exe
File opened for modification	C:\Windows\SysWOW64\eattiteat-ateab.dll	efgufeas.exe
File created	C:\Windows\SysWOW64\eattiteat-ateab.dll	efgufeas.exe
File opened for modification	C:\Windows\SysWOW64\efgufeas.exe	efgufeas.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

efgufeas.exeefgufeas.exe

pid	process
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3840	efgufeas.exe
3840	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe
3648	efgufeas.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

efgufeas.exe

description pid process

Token: SeDebugPrivilege 3648 efgufeas.exe

description	pid	process
Token: SeDebugPrivilege	3648	efgufeas.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exeefgufeas.exe

description	pid	process	target process
PID 3556 wrote to memory of 3648	3556	590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe	efgufeas.exe
PID 3556 wrote to memory of 3648	3556	590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe	efgufeas.exe
PID 3556 wrote to memory of 3648	3556	590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe	efgufeas.exe
PID 3648 wrote to memory of 596	3648	efgufeas.exe	winlogon.exe
PID 3648 wrote to memory of 3840	3648	efgufeas.exe	efgufeas.exe
PID 3648 wrote to memory of 3840	3648	efgufeas.exe	efgufeas.exe
PID 3648 wrote to memory of 3840	3648	efgufeas.exe	efgufeas.exe
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE
PID 3648 wrote to memory of 3408	3648	efgufeas.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:596

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408

C:\Users\Admin\AppData\Local\Temp\590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\590d8f7a38ff6a27505cca0a9e090530_NeikiAnalytics.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\SysWOW64\efgufeas.exe
"C:\Windows\SysWOW64\efgufeas.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648

C:\Windows\SysWOW64\efgufeas.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\alrideag-odix.exe

Filesize
73KB

MD5
e386cec63cb4d897a2026ee3a9d939f2

SHA1
5302b9addbb57dcab3dc0d2199feefe8f5ea0fa1

SHA256
9f604f6a326c7aab9b50b3ff1c88066a946a4e79fb9944efa8333e720bd007e5

SHA512
6cdffaf292f698017dad7e77ffcea592dcab4c99346bc254580957dfb762f14c64ec8c8a8fc88bd2a611f4344037d2f4c550c2a7e4bb7c2560a329037822937d

Download Submit
C:\Windows\SysWOW64\eattiteat-ateab.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\efgufeas.exe

Filesize
70KB

MD5
86de88a7af2568c1192596e67f3eefba

SHA1
64e373c170670ea521c364a9988b563f070b6ad8

SHA256
39a4fb18c6cb37b49bb07d960a974c20c9bdf05cddd46fc56708a493c780d7ee

SHA512
3aab4d5105b1e5ddc87ebec3776f789be78a07c67242870a212761bf0f6d064e70502d2197dd99dc2fa3aa683402aa481aa78610fc986d83450806b9a68cffeb

Download Submit
C:\Windows\SysWOW64\eplatac.exe

Filesize
72KB

MD5
de519d66b112418266b985444ce2ce58

SHA1
2241a8e92fddfccab372f972987de847362e2fda

SHA256
1df6834290473526d5996fc5b1ae8b751c1de41b9c3e732d569ed0c800f0dc35

SHA512
17d70f02b487f1af0e3b597f7d551d7942186f7c9060aec6ce3765d97d1e027b04eded293ae7e28d2c8aca2d999e9eefd90a40541d6481cea5865f77ce6a2e24

Download Submit
memory/3556-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3648-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3840-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads