Analysis
-
max time kernel
79s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe
-
Size
5.3MB
-
MD5
6dc3136c0271899f92093c4b95e1aed0
-
SHA1
c6fc23c61735691495306306e896db62770d3b08
-
SHA256
b73ac73453769556d1728dbd88a496ba587c9da32d3db8034e50696f192ebc3a
-
SHA512
dd78fa6f153bdf990f545740947e71524d06aec21b46b3ab71b7f180940e6fefdcef0db91fe17c97564e91aa70fc862b8016e1c895dd725f8f50c787541a4aea
-
SSDEEP
98304:34Gr/W2hRkTwVNt6MkTi+XAVd18EjU6+cVX6IwUu:3jr/TMwVNtaP4KEjl6S
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2088-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2088-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2320 powershell.exe 948 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1948 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
dddbhxbblxrl.exepid process 476 2760 dddbhxbblxrl.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 476 -
Processes:
resource yara_rule behavioral1/memory/2088-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2088-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
dddbhxbblxrl.exepowershell.exe6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe dddbhxbblxrl.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dddbhxbblxrl.exedescription pid process target process PID 2760 set thread context of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 set thread context of 2088 2760 dddbhxbblxrl.exe nslookup.exe -
Drops file in Windows directory 2 IoCs
Processes:
wusa.exewusa.exedescription ioc process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2652 sc.exe 2692 sc.exe 620 sc.exe 944 sc.exe 2552 sc.exe 2884 sc.exe 1508 sc.exe 2412 sc.exe 2376 sc.exe 2768 sc.exe 2260 sc.exe 2204 sc.exe 1968 sc.exe 2672 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0a6dfd6b0acda01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exepowershell.exedddbhxbblxrl.exepowershell.exenslookup.exepid process 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2320 powershell.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2332 6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe 2760 dddbhxbblxrl.exe 948 powershell.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2760 dddbhxbblxrl.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe 2088 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exenslookup.exedescription pid process Token: SeDebugPrivilege 2320 powershell.exe Token: SeShutdownPrivilege 2644 powercfg.exe Token: SeShutdownPrivilege 2592 powercfg.exe Token: SeShutdownPrivilege 2588 powercfg.exe Token: SeShutdownPrivilege 2388 powercfg.exe Token: SeDebugPrivilege 948 powershell.exe Token: SeShutdownPrivilege 848 powercfg.exe Token: SeShutdownPrivilege 1080 powercfg.exe Token: SeShutdownPrivilege 2000 powercfg.exe Token: SeShutdownPrivilege 1752 powercfg.exe Token: SeLockMemoryPrivilege 2088 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
cmd.execmd.execmd.exedddbhxbblxrl.exedescription pid process target process PID 2532 wrote to memory of 2620 2532 cmd.exe wusa.exe PID 2532 wrote to memory of 2620 2532 cmd.exe wusa.exe PID 2532 wrote to memory of 2620 2532 cmd.exe wusa.exe PID 1948 wrote to memory of 1616 1948 cmd.exe choice.exe PID 1948 wrote to memory of 1616 1948 cmd.exe choice.exe PID 1948 wrote to memory of 1616 1948 cmd.exe choice.exe PID 1352 wrote to memory of 1260 1352 cmd.exe wusa.exe PID 1352 wrote to memory of 1260 1352 cmd.exe wusa.exe PID 1352 wrote to memory of 1260 1352 cmd.exe wusa.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2152 2760 dddbhxbblxrl.exe conhost.exe PID 2760 wrote to memory of 2088 2760 dddbhxbblxrl.exe nslookup.exe PID 2760 wrote to memory of 2088 2760 dddbhxbblxrl.exe nslookup.exe PID 2760 wrote to memory of 2088 2760 dddbhxbblxrl.exe nslookup.exe PID 2760 wrote to memory of 2088 2760 dddbhxbblxrl.exe nslookup.exe PID 2760 wrote to memory of 2088 2760 dddbhxbblxrl.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "NCUDPJVW"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "NCUDPJVW" binpath= "C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "NCUDPJVW"2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\6dc3136c0271899f92093c4b95e1aed0_NeikiAnalytics.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exeC:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\eowgjsemsmrx\dddbhxbblxrl.exeFilesize
5.3MB
MD56dc3136c0271899f92093c4b95e1aed0
SHA1c6fc23c61735691495306306e896db62770d3b08
SHA256b73ac73453769556d1728dbd88a496ba587c9da32d3db8034e50696f192ebc3a
SHA512dd78fa6f153bdf990f545740947e71524d06aec21b46b3ab71b7f180940e6fefdcef0db91fe17c97564e91aa70fc862b8016e1c895dd725f8f50c787541a4aea
-
memory/948-17-0x0000000019F80000-0x000000001A262000-memory.dmpFilesize
2.9MB
-
memory/948-18-0x00000000009A0000-0x00000000009A8000-memory.dmpFilesize
32KB
-
memory/2088-36-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-39-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-34-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-41-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-33-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-38-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-40-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-30-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-28-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-37-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-32-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-35-0x00000000002F0000-0x0000000000310000-memory.dmpFilesize
128KB
-
memory/2088-29-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2088-31-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2152-19-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2152-22-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2152-21-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2152-26-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2152-20-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2152-24-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2320-5-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/2320-4-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmpFilesize
4KB
-
memory/2320-10-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmpFilesize
9.6MB
-
memory/2320-12-0x0000000002BDB000-0x0000000002C42000-memory.dmpFilesize
412KB
-
memory/2320-8-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmpFilesize
9.6MB
-
memory/2320-6-0x0000000002820000-0x0000000002828000-memory.dmpFilesize
32KB
-
memory/2320-7-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmpFilesize
9.6MB
-
memory/2320-9-0x0000000002BD4000-0x0000000002BD7000-memory.dmpFilesize
12KB
-
memory/2320-11-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmpFilesize
9.6MB