Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 06:31
Static task
static1
Behavioral task
behavioral1
Sample
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe
-
Size
1.8MB
-
MD5
e5e45a55f6a8b2b63d0265cc715210d0
-
SHA1
097a8c59ba7f7a7829fe51b8b02c475435ae5364
-
SHA256
d0d5c037c5738e95289d2b6454286a507961b6bc954388e89a282c6102b78092
-
SHA512
bfba4d0e647d2eb73e21d1e263d31992948eae121d868970daf77614eac0345dd1461cf3491284ed140ead11dbffd2741697c7c9f084ff6d29ab4f2a852adeaa
-
SSDEEP
49152:xWixbpVndRcpfqwYO3u2XoKNLlMDEe/pmVS/F0jQU:xXdnfnwp3oOLuB/3/uQU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
install.exepid process 2428 install.exe -
Loads dropped DLL 2 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exeinstall.exepid process 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2428 install.exe -
Processes:
resource yara_rule behavioral1/memory/2904-4-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-6-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-8-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-11-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-7-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-9-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-10-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-22-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-16-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-13-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-17-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-75-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-76-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-80-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-82-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-83-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-85-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-88-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-89-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-91-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-94-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-107-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-108-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-111-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-112-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-116-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-117-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-122-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-125-0x00000000025E0000-0x000000000369A000-memory.dmp upx behavioral1/memory/2904-129-0x00000000025E0000-0x000000000369A000-memory.dmp upx -
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\E: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\K: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\X: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\J: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\Q: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\R: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\U: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\G: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\I: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\M: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\N: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\P: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\W: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\Y: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\H: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\L: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\O: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\S: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\T: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\V: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened (read-only) \??\Z: e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened for modification F:\autorun.inf e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zFM.exe e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process File created C:\Windows\f76931b e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exepid process 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
install.exepid process 2428 install.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription pid process target process PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1824 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe DllHost.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 2428 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe install.exe PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE PID 2904 wrote to memory of 1192 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe taskhost.exe PID 2904 wrote to memory of 1292 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Dwm.exe PID 2904 wrote to memory of 1352 2904 e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\1c363bcd07ffc677a8a497ef0c\install.exec:\1c363bcd07ffc677a8a497ef0c\.\install.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\1c363bcd07ffc677a8a497ef0c\eula.1031.txtFilesize
17KB
MD59147a93f43d8e58218ebcb15fda888c9
SHA18277c722ba478be8606d8429de3772b5de4e5f09
SHA256a75019ac38e0d3570633fa282f3d95d20763657f4a2fe851fae52a3185d1eded
SHA512cc9176027621a590a1d4f6e17942012023e3fabc3316bc62c4b17cd61ce76bf5cf270bd32da95dba7ddf3163e84114be1103a6f810ca1a05d914712895f09705
-
C:\Users\Admin\AppData\Local\Temp\0F769398_Rar\e5e45a55f6a8b2b63d0265cc715210d0_NeikiAnalytics.exeFilesize
1.7MB
MD5b936f0f378b9a35489353e878154e899
SHA156719288ab6514c07ac2088119d8a87056eeb94a
SHA256c6a7e484f4d84883bc1205bccea3114c0521025712922298ede9b2a1cd632357
SHA512acdf7b464a258b3ae3015c808d0e08a697ba3209662faa9b18c1aee882bf236dc725f6c3425cb6f9e10d8ab5cbb82ac118ff947a4b9ec6f91c2e150b0beef70f
-
C:\aune.pifFilesize
97KB
MD5f8d30ded34b56cfc4c6f272e389e2e20
SHA1463ea1bacedd25ae6950b1790e2197c87f32d835
SHA256494f12c9ca081f9ec7a243f774441455808b81b36052c9101f2ad19942cb8995
SHA51276ef37c62c4bf78c1394f45a3f1c67b7211ac679324706a09ac3da8631c9f38f212ebcde66766d97154423339838b91e539408b584fd213c0bf6e488305e4577
-
\1c363bcd07ffc677a8a497ef0c\install.exeFilesize
549KB
MD5520a6d1cbcc9cf642c625fe814c93c58
SHA1fb517abb38e9ccc67de411d4f18a9446c11c0923
SHA25608966ce743aa1cbed0874933e104ef7b913188ecd8f0c679f7d8378516c51da2
SHA512b92a32b27d6e6187c30d8018d7e0a35bde98dc524eabcd7709420b499778159e2872db04a3f2dfacf016d0e6d97b8175920e83fa28804609786828e52f058ff0
-
\??\c:\1c363bcd07ffc677a8a497ef0c\eula.1033.txtFilesize
9KB
MD599c22d4a31f4ead4351b71d6f4e5f6a1
SHA173207ebe59f6e1073c0d76c8835a312c367b6104
SHA25693a3c629fecfd10c1cf614714efd69b10e89cfcaf94c2609d688b27754e4ab41
SHA51247b7ec5fed06d6c789935e9e95ea245c7c498b859e2c0165a437a7bf0006e447c4df4beeb97484c56446f1dae547a01387bea4e884970380f37432825eb16e94
-
\??\c:\1c363bcd07ffc677a8a497ef0c\globdata.iniFilesize
1KB
MD50a6b586fabd072bd7382b5e24194eac7
SHA160e3c7215c1a40fbfb3016d52c2de44592f8ca95
SHA2567912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
SHA512b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
-
\??\c:\1c363bcd07ffc677a8a497ef0c\install.iniFilesize
843B
MD50da9ab4977f3e7ba8c65734df42fdab6
SHA1b4ed6eea276f1a7988112f3bde0bd89906237c3f
SHA256672621b056188f8d3fa5ab8cd3df4f95530c962af9bb11cf7c9bd1127b3c3605
SHA5121ef58271cdedbdc53615631cc823483f874c89c2d62e0678de9d469a82bd676eb8abd34656caa5128b7edb0eb24dbf0992e5e571a97f7782c933b2be88af3144
-
\??\c:\1c363bcd07ffc677a8a497ef0c\install.res.1033.dllFilesize
89KB
MD59edeb8b1c5c0a4cd3a3016b85108127d
SHA19ec25485a7ff52d1211a28cca095950901669b34
SHA2569bf7026a47daab7bb2948fd23e8cf42c06dd2e19ef8cdea0af7367453674a8f9
SHA512aa2f6dde0aa6d804bcadc169b6d48aad6b485b8e669f1b0c3624848b27bcd37bd3dd9073bddc6bde5c0dd3bc565fd851e161edb0efe9fcaa4636cdcaaec966db
-
\??\c:\1c363bcd07ffc677a8a497ef0c\vc_red.msiFilesize
227KB
MD5e0951d3cb1038eb2d2b2b2f336e1ab32
SHA1500f832b1fcd869e390457ff3dc005ba5b8cca96
SHA256507ac60e145057764f13cf1ad5366a7e15ddc0da5cc22216f69e3482697d5e88
SHA51234b9c5ed9dd8f384ecf7589e824c3acc824f5f70a36517d35f6d79b0296fbccb699c3ec1e86e749d34643934bf2e20a9c384a5586d368af9887b7c2cede9bfb8
-
\??\c:\1c363bcd07ffc677a8a497ef0c\vcredist.bmpFilesize
5KB
MD506fba95313f26e300917c6cea4480890
SHA131beee44776f114078fc403e405eaa5936c4bc3b
SHA256594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
SHA5127dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
-
memory/1192-28-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2428-105-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/2428-81-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2428-164-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/2428-104-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/2428-106-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/2904-83-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-9-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-16-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-88-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-17-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-37-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/2904-39-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/2904-7-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-75-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-76-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-11-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-8-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-6-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-36-0x0000000000900000-0x0000000000902000-memory.dmpFilesize
8KB
-
memory/2904-80-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-82-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-41-0x0000000000900000-0x0000000000902000-memory.dmpFilesize
8KB
-
memory/2904-85-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-13-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-22-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-40-0x0000000000900000-0x0000000000902000-memory.dmpFilesize
8KB
-
memory/2904-91-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-10-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-0-0x0000000001000000-0x00000000011E0000-memory.dmpFilesize
1.9MB
-
memory/2904-94-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-107-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-108-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-111-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-112-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-116-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-117-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-122-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-125-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-129-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-145-0x0000000000900000-0x0000000000902000-memory.dmpFilesize
8KB
-
memory/2904-89-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB
-
memory/2904-4-0x00000000025E0000-0x000000000369A000-memory.dmpFilesize
16.7MB