Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:31
Static task
static1
Behavioral task
behavioral1
Sample
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe
-
Size
61KB
-
MD5
6df5cea00534b59dd3e1c77fef88e820
-
SHA1
761291f1ef924546ca71892a6ebecdfc48f4649d
-
SHA256
949d9e66f4f964f9d96d5f80d0e7a68397b50a37b8b9de0b217feb0deb170026
-
SHA512
6135a2b23afb6772f3b0a73f0b891e518177b24d041eee7029ba4795138d7f623b8a1533f8c87c435a68f583b8fbc250b4eb0e7722c00f22e9ba9a34ccfdc89a
-
SSDEEP
1536:IkFbk5BoYFUOnUevuMTQn4gFTk57TVcrwNMxcgY:IkbYwsuVniXJgY
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D30B1D6-2FD2-0B7A-E8B1-B86FB2D9E123} 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8D30B1D6-2FD2-0B7A-E8B1-B86FB2D9E123}\stubpath = "%SystemRoot%\\system32\\vmtoolsd.exe" 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3020 cmd.exe -
Drops file in System32 directory 2 IoCs
Processes:
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\vmtoolsd.exe 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\vmtoolsd.exe 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exedescription pid process Token: SeIncBasePriorityPrivilege 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exedescription pid process target process PID 2292 wrote to memory of 2204 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe reg.exe PID 2292 wrote to memory of 2204 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe reg.exe PID 2292 wrote to memory of 2204 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe reg.exe PID 2292 wrote to memory of 2204 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe reg.exe PID 2292 wrote to memory of 3020 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe cmd.exe PID 2292 wrote to memory of 3020 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe cmd.exe PID 2292 wrote to memory of 3020 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe cmd.exe PID 2292 wrote to memory of 3020 2292 6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6df5cea00534b59dd3e1c77fef88e820_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{8D30B1D6-2FD2-0B7A-E8B1-B86FB2D9E123}" /f2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6DF5CE~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2292-1-0x0000000000401000-0x0000000000410000-memory.dmpFilesize
60KB
-
memory/2292-5-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2292-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2292-6-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2292-7-0x0000000000401000-0x0000000000410000-memory.dmpFilesize
60KB