Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
7712c7f5db2b173cb4cc845469ba2fb0
-
SHA1
e97d31de4428f70a56047b66e793dceb3d7bfd7e
-
SHA256
ec8190ed62c3735d6849a5d7445126e1a4b748415ba75fa0e40249b662b9eaa8
-
SHA512
a57d0e70bb35c328154196d001bc5a3433e71b5b91204bc4e814ebfb184b91e872c5d3c69f522e49c5344ff7b275a3aa12ea70698330298833a2c2babb8afc43
-
SSDEEP
1536:vNJg8r8Qs4LuPgzl7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:c4LegzlJJjmLM3zRJWZsXy4JN
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
niorut.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" niorut.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
niorut.exepid process 4040 niorut.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
niorut.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niorut = "C:\\Users\\Admin\\niorut.exe" niorut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
niorut.exepid process 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe 4040 niorut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exeniorut.exepid process 2948 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe 4040 niorut.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exeniorut.exedescription pid process target process PID 2948 wrote to memory of 4040 2948 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe niorut.exe PID 2948 wrote to memory of 4040 2948 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe niorut.exe PID 2948 wrote to memory of 4040 2948 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe niorut.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe PID 4040 wrote to memory of 2948 4040 niorut.exe 7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7712c7f5db2b173cb4cc845469ba2fb0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\niorut.exe"C:\Users\Admin\niorut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\niorut.exeFilesize
53KB
MD5500a2712dd95687119b08642238a2521
SHA10b68750a35f840a8329c5d92b56a4a7be55fdc1f
SHA256224ae58fc9d21ba1e610bf7fdab00a2ea67f903a59c72860fc00cd1634fa6fd6
SHA5126b7f904a57d901bf6f13e4287785ab0f5a44a4d3150257c9789e994ff8f44f0dc8accba70c650ff5f5357df9f346a339e16c51e763a01bb440c38fdf1e089f54
-
memory/2948-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4040-33-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB