108f422d7d266ed96d0668f92f84a7fb1371c478a59c4b372cf4dba1676329c9

General

Target

6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
Size

73KB
MD5

6eed5303d444dd20f35a27e641611b70
SHA1

3faa78264bf95c9e97cfba38368e8c7b19829a86
SHA256

108f422d7d266ed96d0668f92f84a7fb1371c478a59c4b372cf4dba1676329c9
SHA512

728e71027732060410e357f96bbc586f1db522ac8aaf7a79a4baeba962d7128abc24255620fa284b5e301b82282f43d6a6b63351c3631c13403aa1f58a080035
SSDEEP

768:x/nlrF9TAbYmFr1BndWdhKjJFJLLeTYSOmPPxfXjGca8Iaxqm4Ts9s5qCfRpXMRb:x5FNAlTnd+5rO0PxfXZVBZq5qYXMEY

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eafxahom.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}\IsInstalled = "1"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}\StubPath = "C:\\Windows\\system32\\ifxenid.exe"	eafxahom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	eafxahom.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ihkoagead.exe"	eafxahom.exe

Executes dropped EXE 2 IoCs

Processes:

eafxahom.exeeafxahom.exe

pid process

4708 eafxahom.exe
868 eafxahom.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	eafxahom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	eafxahom.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

eafxahom.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	eafxahom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\urvoopug.dll"	eafxahom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	eafxahom.exe

Drops file in System32 directory 9 IoCs

Processes:

eafxahom.exe6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ifxenid.exe	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\urvoopug.dll	eafxahom.exe
File created	C:\Windows\SysWOW64\urvoopug.dll	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\eafxahom.exe	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\eafxahom.exe	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\eafxahom.exe	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ihkoagead.exe	eafxahom.exe
File created	C:\Windows\SysWOW64\ihkoagead.exe	eafxahom.exe
File opened for modification	C:\Windows\SysWOW64\ifxenid.exe	eafxahom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

eafxahom.exeeafxahom.exe

pid	process
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
868	eafxahom.exe
868	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe
4708	eafxahom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eafxahom.exe

description pid process

Token: SeDebugPrivilege 4708 eafxahom.exe

description	pid	process
Token: SeDebugPrivilege	4708	eafxahom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exeeafxahom.exe

description	pid	process	target process
PID 4900 wrote to memory of 4708	4900	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 4900 wrote to memory of 4708	4900	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 4900 wrote to memory of 4708	4900	6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe	eafxahom.exe
PID 4708 wrote to memory of 616	4708	eafxahom.exe	winlogon.exe
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 868	4708	eafxahom.exe	eafxahom.exe
PID 4708 wrote to memory of 868	4708	eafxahom.exe	eafxahom.exe
PID 4708 wrote to memory of 868	4708	eafxahom.exe	eafxahom.exe
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE
PID 4708 wrote to memory of 3464	4708	eafxahom.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464

C:\Users\Admin\AppData\Local\Temp\6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6eed5303d444dd20f35a27e641611b70_NeikiAnalytics.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\eafxahom.exe
"C:\Windows\SysWOW64\eafxahom.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\eafxahom.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\eafxahom.exe
Filesize
71KB

MD5
10cc36ddb68e2565429fc1da9fb58212

SHA1
cf778c73e30d6f38753a787a2f69d9fbfa6dd48f

SHA256
924db02be7a3d444f98b6af608d7aa87abc8fed618b83070caa030bcbd930331

SHA512
1ae4314b8b3fca38303df6cd846a29018f55d8d102c064764419aac9dee13cc8d479848e40023ca506946aca09650eea793d3252d2254dc790afbe7177d5c80e

Download Submit
C:\Windows\SysWOW64\ifxenid.exe
Filesize
73KB

MD5
9c1baae61579db90ac3703f52bcec72d

SHA1
2f49de5f974da416074aa54b56dc64b9bd6dd8a5

SHA256
00740e35b661acf832e9d2b1a9771ac46e3d8b8078023139b80247193397421e

SHA512
f37a088bd4461c60d744e5f25ad41c66c3acffd56fd4cda5671f93b72501e0200fcee6094231bdd6ac5de8757fbb7189e0e12de2f314529392844eca376668a2

Download Submit
C:\Windows\SysWOW64\ihkoagead.exe
Filesize
74KB

MD5
b0d5939aff62a8f2b68f7736a01204d5

SHA1
08bc257873ed040965184854236e73321b81f3cc

SHA256
b659195de2a65d1a275473e4bb3e64afffbde358c80d46bb3b11e6bb16530033

SHA512
af77ad20374d833c6ea14e1ea6247f73c68790416dab8eaef54db02db02d75361538c9669ee31149b9b91d8943745189221e32f679186b8b751ae88f923d56b0

Download Submit
C:\Windows\SysWOW64\urvoopug.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
memory/868-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4708-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4900-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads