Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe
-
Size
5.3MB
-
MD5
7788601bd28ef98aa4a4a477a33e9cc0
-
SHA1
1dff5df64ed658249bcac6f999b295b7b3651ce3
-
SHA256
8deedc9bb91016728eb0e610e79fda04cdaa748bd9b6b67f09ec1d807ad75758
-
SHA512
63caa3ba22aaddf2688d88453f6c8fab59c28c8d504527f03618c5dffa7653ae1bb8097b9408fcac9a5f731d5a0a430ba7aa9beb400690a4163abdecd700e6c7
-
SSDEEP
98304:KggSZTFznDHwE8oohoIgNgx+r3P4jw4fn9E32RW0O2gT/gQGhP3oFL6p4kvDZ/Hn:DgSZJznDHMo+JgNgx+r3P+e32BO2gjgj
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1508-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1508-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2648 powershell.exe 2032 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2780 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
fqwofdtexigy.exepid process 476 1676 fqwofdtexigy.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 476 -
Processes:
resource yara_rule behavioral1/memory/1508-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1508-40-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exe7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exepowershell.exefqwofdtexigy.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe fqwofdtexigy.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fqwofdtexigy.exedescription pid process target process PID 1676 set thread context of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 set thread context of 1508 1676 fqwofdtexigy.exe nslookup.exe -
Drops file in Windows directory 2 IoCs
Processes:
wusa.exewusa.exedescription ioc process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1796 sc.exe 2232 sc.exe 2400 sc.exe 2528 sc.exe 2524 sc.exe 1040 sc.exe 636 sc.exe 2700 sc.exe 2644 sc.exe 2200 sc.exe 332 sc.exe 2620 sc.exe 3016 sc.exe 2764 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0ac5a72b8acda01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exepowershell.exefqwofdtexigy.exepowershell.exenslookup.exepid process 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2648 powershell.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 2916 7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe 1676 fqwofdtexigy.exe 2032 powershell.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1676 fqwofdtexigy.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe 1508 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exenslookup.exedescription pid process Token: SeDebugPrivilege 2648 powershell.exe Token: SeShutdownPrivilege 2532 powercfg.exe Token: SeShutdownPrivilege 2488 powercfg.exe Token: SeShutdownPrivilege 2512 powercfg.exe Token: SeShutdownPrivilege 2544 powercfg.exe Token: SeDebugPrivilege 2032 powershell.exe Token: SeShutdownPrivilege 1632 powercfg.exe Token: SeShutdownPrivilege 568 powercfg.exe Token: SeShutdownPrivilege 1472 powercfg.exe Token: SeShutdownPrivilege 584 powercfg.exe Token: SeLockMemoryPrivilege 1508 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
cmd.execmd.execmd.exefqwofdtexigy.exedescription pid process target process PID 2864 wrote to memory of 2752 2864 cmd.exe wusa.exe PID 2864 wrote to memory of 2752 2864 cmd.exe wusa.exe PID 2864 wrote to memory of 2752 2864 cmd.exe wusa.exe PID 2780 wrote to memory of 2932 2780 cmd.exe choice.exe PID 2780 wrote to memory of 2932 2780 cmd.exe choice.exe PID 2780 wrote to memory of 2932 2780 cmd.exe choice.exe PID 1872 wrote to memory of 2176 1872 cmd.exe wusa.exe PID 1872 wrote to memory of 2176 1872 cmd.exe wusa.exe PID 1872 wrote to memory of 2176 1872 cmd.exe wusa.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 2436 1676 fqwofdtexigy.exe conhost.exe PID 1676 wrote to memory of 1508 1676 fqwofdtexigy.exe nslookup.exe PID 1676 wrote to memory of 1508 1676 fqwofdtexigy.exe nslookup.exe PID 1676 wrote to memory of 1508 1676 fqwofdtexigy.exe nslookup.exe PID 1676 wrote to memory of 1508 1676 fqwofdtexigy.exe nslookup.exe PID 1676 wrote to memory of 1508 1676 fqwofdtexigy.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JVNIRHNX"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JVNIRHNX" binpath= "C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JVNIRHNX"2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7788601bd28ef98aa4a4a477a33e9cc0_NeikiAnalytics.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeC:\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\xhzmmmxzrrwn\fqwofdtexigy.exeFilesize
5.3MB
MD57788601bd28ef98aa4a4a477a33e9cc0
SHA11dff5df64ed658249bcac6f999b295b7b3651ce3
SHA2568deedc9bb91016728eb0e610e79fda04cdaa748bd9b6b67f09ec1d807ad75758
SHA51263caa3ba22aaddf2688d88453f6c8fab59c28c8d504527f03618c5dffa7653ae1bb8097b9408fcac9a5f731d5a0a430ba7aa9beb400690a4163abdecd700e6c7
-
memory/1508-39-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-29-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-37-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-34-0x0000000000040000-0x0000000000060000-memory.dmpFilesize
128KB
-
memory/1508-35-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-27-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-36-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-28-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-38-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-33-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-40-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-30-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-31-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1508-32-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2032-17-0x0000000000950000-0x0000000000958000-memory.dmpFilesize
32KB
-
memory/2032-16-0x0000000019F70000-0x000000001A252000-memory.dmpFilesize
2.9MB
-
memory/2436-19-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2436-21-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2436-18-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2436-24-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2436-20-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2436-22-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2648-11-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmpFilesize
9.6MB
-
memory/2648-4-0x000007FEF565E000-0x000007FEF565F000-memory.dmpFilesize
4KB
-
memory/2648-10-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmpFilesize
9.6MB
-
memory/2648-9-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmpFilesize
9.6MB
-
memory/2648-8-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmpFilesize
9.6MB
-
memory/2648-6-0x00000000027A0000-0x00000000027A8000-memory.dmpFilesize
32KB
-
memory/2648-7-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmpFilesize
9.6MB
-
memory/2648-5-0x000000001B5D0000-0x000000001B8B2000-memory.dmpFilesize
2.9MB