108f422d7d266ed96d0668f92f84a7fb1371c478a59c4b372cf4dba1676329c9

General

Target

6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
Size

73KB
MD5

6eed5303d444dd20f35a27e641611b70
SHA1

3faa78264bf95c9e97cfba38368e8c7b19829a86
SHA256

108f422d7d266ed96d0668f92f84a7fb1371c478a59c4b372cf4dba1676329c9
SHA512

728e71027732060410e357f96bbc586f1db522ac8aaf7a79a4baeba962d7128abc24255620fa284b5e301b82282f43d6a6b63351c3631c13403aa1f58a080035
SSDEEP

768:x/nlrF9TAbYmFr1BndWdhKjJFJLLeTYSOmPPxfXjGca8Iaxqm4Ts9s5qCfRpXMRb:x5FNAlTnd+5rO0PxfXZVBZq5qYXMEY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eafxahom.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\ifxenid.exe"	eafxahom.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ihkoagead.exe"	eafxahom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eafxahom.exe

Executes dropped EXE 2 IoCs

Processes:

eafxahom.exeeafxahom.exe

pid process

1892 eafxahom.exe
2744 eafxahom.exe
Loads dropped DLL 3 IoCs

Processes:

6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exeeafxahom.exe

pid process

2312 6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
2312 6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
1892 eafxahom.exe

pid	process
1892	eafxahom.exe
2744	eafxahom.exe

pid	process
2312	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
2312	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
1892	eafxahom.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eafxahom.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\urvoopug.dll"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eafxahom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eafxahom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eafxahom.exe

Drops file in System32 directory 9 IoCs

Processes:

6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exeeafxahom.exe

description	ioc	process
File created	C:\Windows\SysWOW64\eafxahom.exe	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ihkoagead.exe	eafxahom.exe
File created	C:\Windows\SysWOW64\ihkoagead.exe	eafxahom.exe
File created	C:\Windows\SysWOW64\urvoopug.dll	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\eafxahom.exe	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\eafxahom.exe	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ifxenid.exe	eafxahom.exe
File created	C:\Windows\SysWOW64\ifxenid.exe	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\urvoopug.dll	eafxahom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eafxahom.exeeafxahom.exe

pid	process
2744	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe
1892	eafxahom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eafxahom.exe

description pid process

Token: SeDebugPrivilege 1892 eafxahom.exe

description	pid	process
Token: SeDebugPrivilege	1892	eafxahom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exeeafxahom.exe

description	pid	process	target process
PID 2312 wrote to memory of 1892	2312	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 2312 wrote to memory of 1892	2312	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 2312 wrote to memory of 1892	2312	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 2312 wrote to memory of 1892	2312	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 1892 wrote to memory of 2744	1892	eafxahom.exe	eafxahom.exe
PID 1892 wrote to memory of 2744	1892	eafxahom.exe	eafxahom.exe
PID 1892 wrote to memory of 2744	1892	eafxahom.exe	eafxahom.exe
PID 1892 wrote to memory of 2744	1892	eafxahom.exe	eafxahom.exe
PID 1892 wrote to memory of 420	1892	eafxahom.exe	winlogon.exe
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE
PID 1892 wrote to memory of 1412	1892	eafxahom.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\eafxahom.exe
"C:\Windows\SysWOW64\eafxahom.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\eafxahom.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2744

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ifxenid.exe
Filesize
73KB

MD5
8ff8ff768aac699263d153c8b8747103

SHA1
03f00fc1c945e0e44e657d3313e4cf84ac9c0c99

SHA256
39b26f7d57792fbcf1090fa43a784c457cd6d481dce9a5dcbd442d408b6ba547

SHA512
761a558916364d95e54b8140f262e32b7b4eb521af3c566baef4596c48e0675f7945e7ee1a97713882e48b8d5de20f3d3285ff985ac8d919ccc9ee61a3dcde26

Download Submit
C:\Windows\SysWOW64\ihkoagead.exe
Filesize
74KB

MD5
00591a71211690177b7a21339bf57e1f

SHA1
d3a17f41650e22854778fb3b9e60fae5d4b92fae

SHA256
3180423da685972b15110f080f2cdbfaa7e51648d6185da81095b309713e6dda

SHA512
e2598723220f9c08a72b26307839de6a41ad594abea7de160b1dc3b63ac7d4a5898d89eac530fe2137ee2f8e0c400331aba0081c1a83b8b7cda789fc6ee598ba

Download Submit
C:\Windows\SysWOW64\urvoopug.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\eafxahom.exe
Filesize
71KB

MD5
10cc36ddb68e2565429fc1da9fb58212

SHA1
cf778c73e30d6f38753a787a2f69d9fbfa6dd48f

SHA256
924db02be7a3d444f98b6af608d7aa87abc8fed618b83070caa030bcbd930331

SHA512
1ae4314b8b3fca38303df6cd846a29018f55d8d102c064764419aac9dee13cc8d479848e40023ca506946aca09650eea793d3252d2254dc790afbe7177d5c80e

Download Submit
memory/1892-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2312-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2744-51-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads