33e75770d8d403a4c9b4aaba6f7a1023bea2ddb762763cdc00fc4feb089772ad

General

Target

67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Size

75KB
MD5

67b342125eaf54c5557c4f358dbcdf20
SHA1

98cab288c690a2ef126f4f0d84739f47924df87e
SHA256

33e75770d8d403a4c9b4aaba6f7a1023bea2ddb762763cdc00fc4feb089772ad
SHA512

97816c9766d113a64b241f00aec1aa5f6ea06e7a13b92520097c4f7b4b50b8cc28b9cb71e050ec516d13fddfd86722e3e0c7737a4632bdeadb6e57e71eb444d2
SSDEEP

1536:Kx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3B:aOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPp

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\shervans.dll	acprotect

Executes dropped EXE 2 IoCs

Processes:

ctfmen.exesmnss.exe

pid process

2916 ctfmen.exe
2536 smnss.exe

pid	process
2916	ctfmen.exe
2536	smnss.exe

Loads dropped DLL 9 IoCs

Processes:

67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exectfmen.exesmnss.exeWerFault.exe

pid	process
2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
2916	ctfmen.exe
2916	ctfmen.exe
2536	smnss.exe
2692	WerFault.exe
2692	WerFault.exe
2692	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

smnss.exe67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exesmnss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe

Drops file in System32 directory 12 IoCs

Processes:

67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exesmnss.exe

description	ioc	process
File created	C:\Windows\SysWOW64\grcopy.dll	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\satornas.dll	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shervans.dll	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\smnss.exe	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe

Drops file in Program Files directory 64 IoCs

Processes:

smnss.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	smnss.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	smnss.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 2536 WerFault.exe smnss.exe

pid	pid_target	process	target process
2692	2536	WerFault.exe	smnss.exe

Modifies registry class 6 IoCs

Processes:

smnss.exe67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

smnss.exe

description pid process

Token: SeDebugPrivilege 2536 smnss.exe

description	pid	process
Token: SeDebugPrivilege	2536	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exectfmen.exesmnss.exe

description	pid	process	target process
PID 2936 wrote to memory of 2916	2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe	ctfmen.exe
PID 2936 wrote to memory of 2916	2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe	ctfmen.exe
PID 2936 wrote to memory of 2916	2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe	ctfmen.exe
PID 2936 wrote to memory of 2916	2936	67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe	ctfmen.exe
PID 2916 wrote to memory of 2536	2916	ctfmen.exe	smnss.exe
PID 2916 wrote to memory of 2536	2916	ctfmen.exe	smnss.exe
PID 2916 wrote to memory of 2536	2916	ctfmen.exe	smnss.exe
PID 2916 wrote to memory of 2536	2916	ctfmen.exe	smnss.exe
PID 2536 wrote to memory of 2692	2536	smnss.exe	WerFault.exe
PID 2536 wrote to memory of 2692	2536	smnss.exe	WerFault.exe
PID 2536 wrote to memory of 2692	2536	smnss.exe	WerFault.exe
PID 2536 wrote to memory of 2692	2536	smnss.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\67b342125eaf54c5557c4f358dbcdf20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\SysWOW64\ctfmen.exe
ctfmen.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\smnss.exe
C:\Windows\system32\smnss.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 808
4⤵
- Loads dropped DLL
- Program crash
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
1d38a9a1b970bbabea538fdbc8275aa9

SHA1
72abb2a18c72698be4442a2129806a533deb7027

SHA256
dbc82442a66ca41a5d96d2a966266de187db76737959ee419338e5f55d8eeb19

SHA512
27cc811338d8a82b215a00757960ac39fdfb1f66ba457d4c3c71380f1a519ad9bbc32ed80809188c3f98752e22903f1792d105666764318a85436ae1387098fa

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
6b9ef9bafe8d38b0ff0d272f9b4eaae7

SHA1
09d44374e33fed9c8e39499c0f1ae1d32c886ec5

SHA256
2948d04d8efc719721dfb8712183cc9e340b9536cb69f4cbbccd48d8ff9ebc23

SHA512
76a52daa26b5e6a684f0b963a797ca420daab00f77b874fdcd088d666f77e3eca7f9b9bd6eae2e6a2d56abcbd37fbc481f617028ac87502e7f4953d04e3ca077

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
ea91c20397aa0db2e35684e074e00793

SHA1
cf966ec4a1b0ac306ec82e9d570bf37de81e3e5a

SHA256
bb4818f307ae21fbb8d2f4bc097486622cfbcf2f5cccaa28d2413ccd0b6ecf5e

SHA512
9a863de72815dbc6a659f17264c677b0c174b07f906bba4784e0e4ebafe7d27f0eff861f329241e2cdd7877063973de3b183171542bbcf1e6295bf5d7da58a09

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
028ca211feb1f22e4a38ae4a57adc932

SHA1
350e072d963e3c9b3fedddc3d3565ac8cb782884

SHA256
15f769be45bc094de8ab27524d691ad480939f8aa33276ed04c2ef0da9d58b5d

SHA512
11188e65d4b153e6ea88fae9bb45de64e2e1a3ba075ec2ec37db313daa20b328a61809e9b8862e614f23006add7a9fbc6cbfb9aef8cd62d141caf3433694f06a

Download Submit
memory/2536-39-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2536-43-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2536-44-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2916-31-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2936-15-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2936-17-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/2936-26-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2936-24-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads