Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 20:38
General
-
Target
3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
3625d8e6bb1b131d26e97eb073e00fa0
-
SHA1
5cf576d58557461d1feeed53df995f780b9a7791
-
SHA256
5f33c4dd99abfb3da89e3b4d721192aeca2e0cb268485989410ea3ef5c4c98db
-
SHA512
4b01f625997ff707fbbf5f101ba9f202e08a7003af0597466a6ad8002e0ebd03cf2578dfa16534a626a9d801e14fdc14a3aa2b2881b4f75ec003002a959ba813
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIu:J8dfX7y9DZ+N7eB+tIu
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
Executes dropped EXE 12 IoCs
-
Loads dropped DLL 21 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD57564c5ff8a123d585372002e35ebf77c
SHA178193b63e105f43e48420bdf4b7310bffd09965f
SHA25694e68ef849bf565a2285333e3de3d9f2d152dd5a36d1b1727600295b977f7445
SHA5120276bb01d88fb2e28f5a0e453e1502be33059a405d3324b77b1adcdd0264304aa59a357c45a57ff708476b36bd1a7d921044cb924a214697de74c0e4ac724304
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
97KB
MD51261cea631b8c27cc9f19ff55267370d
SHA13a354cc691a589c7342f143f71edb96a6654e1d6
SHA2569e94df2496d94d382e7b571063f716e658bd59c9a507ec4c39f02c0f1134bef3
SHA512a70f53d3ba69688bc57fefa073c78dc657507dd3f1ee05f670e7d26bfb284fa5def88c4ffc2cb03217595468bba7fba15fcc6673fc1ae7d0e224b642c3da3d2e
-
Filesize
97KB
MD5d2398439b0f47f95bd73ea46a631f885
SHA14ac9e408dd6844a86ab0a23f7bee45cccee4724b
SHA2562e1ff5a459199fa5da70e061b942b1eb00ec28143ad7c88c6d9b15372d525533
SHA512639613693b3ac0205ab1169f48bbc9b68c37abf1084cf645ee3e19b8bf5687ad33881833f476e41ad3246527806417299988ae4b58ca60799c9c5185d93bf8c5
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD5f5415fc5d4227b170bbcb796a3abdd85
SHA11c60d909b0de619901d6433188d7382015740630
SHA256321f5d5e01c8d6dc0f9389a9fa8fb59f211a3993521d260b259ee3c05daa57a2
SHA5120c8096b9a5eb34b5624bb187ac7d253cc9b4c6dccb8dc271b47da5f6d7fd83f6c1af2a83ecf774ab8dbe6784a77aa402592689534d1d0474d1227834cf45ec87
-
Filesize
97KB
MD5baca84866c017fd8b2a242dc6893dd73
SHA1eb646f7677f1362317603f2ef6741014e01defde
SHA2565e201012313f5704378ad852b3f1b5a3b841dc39fe2a16a168379cf7fb154e4e
SHA512a7168c0d637e903bef874acab22894e50bc5947eb4287096e679f133eaf8cccccbfb908bd294b794b62bdb3fda1853ce39e05d098ddfe0644f74994bd37e6a90
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB