Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 06:28
Static task
static1
Behavioral task
behavioral1
Sample
93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe
-
Size
70KB
-
MD5
93a9312ec2e2b40a4c0bb9d894b660b0
-
SHA1
aecb53fb0f9b725f9709016186c592b744f1d65b
-
SHA256
cc393da4c27a7ac46fa2756f3b2a0eb55d925dd7b797048e188f5e1fb69cacd6
-
SHA512
3539b2e72b6f62a04143c7d367a81cc99cc9ce54905eb9163f2ca5f3155d2071a1f8db3fef98fa7db71cacf736ebdba2c380afd209ed29764c81167632d605c7
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8b2:Olg35GTslA5t3/w8b2
Malware Config
Signatures
-
Processes:
hroced.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" hroced.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
hroced.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} hroced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" hroced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\ossatoc.exe" hroced.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
hroced.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\evcooruv.exe" hroced.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe hroced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" hroced.exe -
Executes dropped EXE 2 IoCs
Processes:
hroced.exehroced.exepid process 3748 hroced.exe 2124 hroced.exe -
Processes:
hroced.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" hroced.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" hroced.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
hroced.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} hroced.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify hroced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" hroced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ihgatet.dll" hroced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" hroced.exe -
Drops file in System32 directory 9 IoCs
Processes:
93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exehroced.exedescription ioc process File opened for modification C:\Windows\SysWOW64\hroced.exe 93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\hroced.exe 93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\evcooruv.exe hroced.exe File created C:\Windows\SysWOW64\ossatoc.exe hroced.exe File opened for modification C:\Windows\SysWOW64\ihgatet.dll hroced.exe File opened for modification C:\Windows\SysWOW64\hroced.exe hroced.exe File opened for modification C:\Windows\SysWOW64\evcooruv.exe hroced.exe File opened for modification C:\Windows\SysWOW64\ossatoc.exe hroced.exe File created C:\Windows\SysWOW64\ihgatet.dll hroced.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hroced.exehroced.exepid process 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 2124 hroced.exe 2124 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe 3748 hroced.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exehroced.exedescription pid process Token: SeDebugPrivilege 744 93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe Token: SeDebugPrivilege 3748 hroced.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exehroced.exedescription pid process target process PID 744 wrote to memory of 3748 744 93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe hroced.exe PID 744 wrote to memory of 3748 744 93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe hroced.exe PID 744 wrote to memory of 3748 744 93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe hroced.exe PID 3748 wrote to memory of 616 3748 hroced.exe winlogon.exe PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 2124 3748 hroced.exe hroced.exe PID 3748 wrote to memory of 2124 3748 hroced.exe hroced.exe PID 3748 wrote to memory of 2124 3748 hroced.exe hroced.exe PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE PID 3748 wrote to memory of 3500 3748 hroced.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\93a9312ec2e2b40a4c0bb9d894b660b0_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\hroced.exe"C:\Windows\system32\hroced.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\hroced.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\evcooruv.exeFilesize
73KB
MD5859b1bdc7568e76c7236142ff50efaa9
SHA1ed1f898c5b37f66ff1ab8c8cfbb7d0c77ec2f3a9
SHA256e951a42cfec678f703bd042adc4ea532c50228a45a0a280b813b682ef54b60e2
SHA512a4d2aa57dee32c6a6418f13382b4bc0ddd58e1216a086656bcf763f025a9d17b532c69ee70d0400c69eddaeacf8bfc390b05faf91199d9369777e060b2dfe4b5
-
C:\Windows\SysWOW64\hroced.exeFilesize
70KB
MD593a9312ec2e2b40a4c0bb9d894b660b0
SHA1aecb53fb0f9b725f9709016186c592b744f1d65b
SHA256cc393da4c27a7ac46fa2756f3b2a0eb55d925dd7b797048e188f5e1fb69cacd6
SHA5123539b2e72b6f62a04143c7d367a81cc99cc9ce54905eb9163f2ca5f3155d2071a1f8db3fef98fa7db71cacf736ebdba2c380afd209ed29764c81167632d605c7
-
C:\Windows\SysWOW64\ihgatet.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
C:\Windows\SysWOW64\ossatoc.exeFilesize
72KB
MD565e73831364c92188925e0831ba8950f
SHA187608b4400c77ecbb238bc8f9e1b3661450b0ab3
SHA256dcb725452d549abbd24dfa32768a321ac6ca56e118aeacd42ffa34a2cf5ec182
SHA5126233c02ab36213ebcaa88fefc2e2aa88196d7216b0a253eade4494e0581415d8ff7ce2c1eb50e4bf7541465df64f03f95101803cb141ee179ac3507bbfbff726
-
memory/744-6-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2124-50-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3748-49-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB