Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 20:38
General
-
Target
3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
3625d8e6bb1b131d26e97eb073e00fa0
-
SHA1
5cf576d58557461d1feeed53df995f780b9a7791
-
SHA256
5f33c4dd99abfb3da89e3b4d721192aeca2e0cb268485989410ea3ef5c4c98db
-
SHA512
4b01f625997ff707fbbf5f101ba9f202e08a7003af0597466a6ad8002e0ebd03cf2578dfa16534a626a9d801e14fdc14a3aa2b2881b4f75ec003002a959ba813
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIu:J8dfX7y9DZ+N7eB+tIu
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 12 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 29 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 20 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3625d8e6bb1b131d26e97eb073e00fa0_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59701b8ac3a07d2feff1c698def5a98b7
SHA1cbd3bb135accf8a9ed17dc9afde62d6c4c45e570
SHA25657ff679fe3c6f42a9f1c60aa19c55d89ff947b199c66c6a4e2bdcd05e9432835
SHA5122c31d712b762bd428212786129d3a8b6b8450c9e058a47b93f4f1820b6e252cd190d979659e0d78654bf69cac0c57d0309c12c1c30ffc8089dc5204b32aaf7c4
-
Filesize
97KB
MD5e318e5ad4c9882de79f691b7bed1fe6b
SHA1d6acaf0467f3956d7b088038d897bcb0a3de2bc2
SHA256d7542215bc75f0cba79624149a082c55d6131173f6144f74696dcf0f1bc35e90
SHA512ce81b23c37e62aa2c7daad0f8990d1e468631df7b62545ba9c2ab8668e69ef79d1eaa21d3914bf7d6ada3a852217462a8750b445e15732c94013f8cd69b2d6f1
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
97KB
MD5cec1f552c3223587c9388e7a8042c05f
SHA1628671845f9037632538aecc594c5ff58e5434d8
SHA256b39025a579d6c7c774082003db1bf9ae2c336deb89ef2ee2ae6f6ed62990cf76
SHA512c3e90c7cf06d3d32c418307f335c13de5b81226159a8b148f1ac85bd6e3182ab8c4c49adf55b71703acd6601d707967c470263a34a99a82873388daf2c91fa3d
-
Filesize
97KB
MD5bd40da6f32a2407da6e81ef8fc67d817
SHA1c292c0f35109d6db083012e1c67149aad9c453a8
SHA2568dc6fdc9c44e3d1d3470e4602873ba7cea273509b103398c851a7ba5302d67de
SHA51271c657eb2513c4f04cccb978c5750218162e6da09866416497acf5aa4fb1339f7e6e7ed5670cf3bbd53b8b15b47ef60264d11a65a176bb6dd68d8230ca261935
-
Filesize
97KB
MD5c33068f0c91064c1f15ae64bbb004bac
SHA1ea4a26ab037fcf23c82755a401bbd2a538bacd44
SHA256a3d28b301a876fde8d3e5a88e7be69688276bb5b1dd977ee1ac0c63c44b7962f
SHA5122207fb1d5724149dd23bddf83fbda2e10b1b4bcca447b126fd80b57c8d037ea5f007cd390c9623749fe2fafcff6b3ff66a9b542be51ef6d17c31a707eabcadc6
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD52fa716f320ae3b5fed36deb8b099e28a
SHA14bef071cf60f07cfa0d20010c80d65b4f098f5c9
SHA25699836b0799076bc3f96420171e6d23c847490d31f112c0df6547c633cd77d6ab
SHA51296d44aa7cd6c92445c518b22d6ab1277b83272f06747d4db73bd722e2748c518812ea0b7a95576d78d8d953ed4eb5f08f51b94762385cde17be28929bd36ebf3
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB