Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
756d0566a907d1a6bbbc0598147137e0
-
SHA1
216e975ca96dac997b13e66a2781161177920ea0
-
SHA256
88f068f27f9a49cc62485d232b0d24ea46b0b363a9645f15c98b2d12a251cc1e
-
SHA512
450179140aaa14d82d46c977f6186e7a21a040a7f13e80f732006de556a4f071577c0d1cfe3fdf016dbd4bcfaa619ec5c2dd51484d0942a3bc527d7816d10f80
-
SSDEEP
1536:vNkg8r8Q7PkT+7Kp3StjEMjmLM3ztDJWZsXy4JzxPMk:YPkCJJjmLM3zRJWZsXy4JN
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
deajook.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deajook.exe -
Executes dropped EXE 1 IoCs
Processes:
deajook.exepid process 2968 deajook.exe -
Loads dropped DLL 2 IoCs
Processes:
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exepid process 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
deajook.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\deajook = "C:\\Users\\Admin\\deajook.exe" deajook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
deajook.exepid process 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe 2968 deajook.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exedeajook.exepid process 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe 2968 deajook.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exedeajook.exedescription pid process target process PID 2896 wrote to memory of 2968 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe deajook.exe PID 2896 wrote to memory of 2968 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe deajook.exe PID 2896 wrote to memory of 2968 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe deajook.exe PID 2896 wrote to memory of 2968 2896 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe deajook.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe PID 2968 wrote to memory of 2896 2968 deajook.exe 756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\756d0566a907d1a6bbbc0598147137e0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\deajook.exe"C:\Users\Admin\deajook.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\deajook.exeFilesize
53KB
MD537fe6efb00d1c4f137091172f8b2cf15
SHA1494530f16ae6e33a5d63ad6317e98cb3108215ba
SHA2568dbf64a3a245bd3e78205602c3ceed6cf34ba225cfa9f4cebdf5518a45c3921d
SHA512ef7d90d2f1afbf6ba326b11237dddeaff6a74eefbbe44a606b66f54c1feca6900c0caf37c4810820c609ae5b2838742b4007a67908df6bd27c6594949c43e87b
-
memory/2896-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2896-15-0x00000000037E0000-0x00000000037F2000-memory.dmpFilesize
72KB
-
memory/2896-14-0x00000000037E0000-0x00000000037F2000-memory.dmpFilesize
72KB
-
memory/2968-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB