Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:16
Behavioral task
behavioral1
Sample
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
3d81f28ac2b34df5162b9cbf8c3584c0
-
SHA1
292b12bd4c2834fa148d81ecf689e6185f995e73
-
SHA256
7e02d1b3b8f23c170fedb6c9dcd7585497d8ef868c37c328ac2becc7407557d5
-
SHA512
74f452d0cc897cf1ad84b95249b96e4d688e399ebfe4b3567a56fc027ea449300cfae1ecd6baf6bfbe92f63d43cd95491da93ce44febe2488b89ec111689d746
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4596-51-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4596-50-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4596-49-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/4596-59-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 2952 csrsll.exe 2188 csrsll.exe 4596 csrsll.exe -
Processes:
resource yara_rule behavioral2/memory/3404-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2484-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2484-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2484-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3404-13-0x0000000000400000-0x0000000000453000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral2/memory/2952-36-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4596-47-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4596-51-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4596-50-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4596-49-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2484-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2952-48-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4596-41-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/2188-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4596-59-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.execsrsll.exedescription pid process target process PID 3404 set thread context of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 2952 set thread context of 2188 2952 csrsll.exe csrsll.exe PID 2952 set thread context of 4596 2952 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe Token: SeDebugPrivilege 2188 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.execsrsll.execsrsll.exepid process 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 2952 csrsll.exe 2188 csrsll.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 3404 wrote to memory of 2484 3404 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe PID 2484 wrote to memory of 1612 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe cmd.exe PID 2484 wrote to memory of 1612 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe cmd.exe PID 2484 wrote to memory of 1612 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe cmd.exe PID 1612 wrote to memory of 4564 1612 cmd.exe reg.exe PID 1612 wrote to memory of 4564 1612 cmd.exe reg.exe PID 1612 wrote to memory of 4564 1612 cmd.exe reg.exe PID 2484 wrote to memory of 2952 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe csrsll.exe PID 2484 wrote to memory of 2952 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe csrsll.exe PID 2484 wrote to memory of 2952 2484 3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 2188 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe PID 2952 wrote to memory of 4596 2952 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3d81f28ac2b34df5162b9cbf8c3584c0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QHRNI.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:4564 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2188 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:4596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\QHRNI.txtFilesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exeFilesize
90KB
MD5480e79b1216400f424b896dc4cb9ae3e
SHA15b83f49d9fd1cc0d4e173b7ccc15ad3bfabeab00
SHA256fe11da3f17c778503976381bbb4ceed2eb67287fd03dd5631cef3050481aa422
SHA51274ade5b3de04660ed586a5cbac6483e2c65ac97ccf9b2d05110e174c022aa998b6a66b309d0c63411a0c5add063be9e7b80ef15d9ff20a05b2287523be5ad569
-
memory/2188-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2484-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2484-55-0x0000000000410000-0x00000000004D9000-memory.dmpFilesize
804KB
-
memory/2484-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2484-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2484-57-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2952-36-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2952-48-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3404-13-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3404-4-0x0000000002A40000-0x0000000002A42000-memory.dmpFilesize
8KB
-
memory/3404-3-0x0000000002A30000-0x0000000002A32000-memory.dmpFilesize
8KB
-
memory/3404-10-0x0000000002A60000-0x0000000002A62000-memory.dmpFilesize
8KB
-
memory/3404-0-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3404-5-0x0000000002A50000-0x0000000002A52000-memory.dmpFilesize
8KB
-
memory/4596-47-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4596-51-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4596-50-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4596-49-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4596-41-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4596-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB