Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 08:15
Static task
static1
Behavioral task
behavioral1
Sample
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe
-
Size
68KB
-
MD5
e7f3d42975ea5294d51d31f92f983c70
-
SHA1
80f215e749df38a358999a0a723237d185eb7fe3
-
SHA256
885295b4ae7dec735e28bf4347224844d5f57e08e758302e189ef80f2b203d8c
-
SHA512
cd53c4681355b520ea92c8bc600f84f6ac94540a8841e98c89aee267e1fb5a6efebb513742884234cc9b22724a453ad16c70848b202e118f257f81f9da29340d
-
SSDEEP
1536:1teqGDlXvCDB04f5Gn/L8ZlALNtnd1Fwg8:6lg35GTclABtnNwd
Malware Config
Signatures
-
Processes:
ottoopuk.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ottoopuk.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
ottoopuk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46} ottoopuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1" ottoopuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\eatdodar.exe" ottoopuk.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
ottoopuk.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ottoopuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ottoopuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\efreamet.exe" ottoopuk.exe -
Executes dropped EXE 2 IoCs
Processes:
ottoopuk.exeottoopuk.exepid process 1116 ottoopuk.exe 2152 ottoopuk.exe -
Loads dropped DLL 3 IoCs
Processes:
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exeottoopuk.exepid process 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe 1116 ottoopuk.exe -
Processes:
ottoopuk.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ottoopuk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ottoopuk.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
ottoopuk.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ottoopuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ochanap.dll" ottoopuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ottoopuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ottoopuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ottoopuk.exe -
Drops file in System32 directory 9 IoCs
Processes:
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exeottoopuk.exedescription ioc process File created C:\Windows\SysWOW64\ottoopuk.exe e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe File created C:\Windows\SysWOW64\eatdodar.exe ottoopuk.exe File opened for modification C:\Windows\SysWOW64\ochanap.dll ottoopuk.exe File opened for modification C:\Windows\SysWOW64\ottoopuk.exe e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\efreamet.exe ottoopuk.exe File created C:\Windows\SysWOW64\efreamet.exe ottoopuk.exe File opened for modification C:\Windows\SysWOW64\eatdodar.exe ottoopuk.exe File created C:\Windows\SysWOW64\ochanap.dll ottoopuk.exe File opened for modification C:\Windows\SysWOW64\ottoopuk.exe ottoopuk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ottoopuk.exeottoopuk.exepid process 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 2152 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe 1116 ottoopuk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exeottoopuk.exedescription pid process Token: SeDebugPrivilege 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe Token: SeDebugPrivilege 1116 ottoopuk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exeottoopuk.exedescription pid process target process PID 1252 wrote to memory of 1116 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe ottoopuk.exe PID 1252 wrote to memory of 1116 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe ottoopuk.exe PID 1252 wrote to memory of 1116 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe ottoopuk.exe PID 1252 wrote to memory of 1116 1252 e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe ottoopuk.exe PID 1116 wrote to memory of 420 1116 ottoopuk.exe winlogon.exe PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 2152 1116 ottoopuk.exe ottoopuk.exe PID 1116 wrote to memory of 2152 1116 ottoopuk.exe ottoopuk.exe PID 1116 wrote to memory of 2152 1116 ottoopuk.exe ottoopuk.exe PID 1116 wrote to memory of 2152 1116 ottoopuk.exe ottoopuk.exe PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE PID 1116 wrote to memory of 1392 1116 ottoopuk.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e7f3d42975ea5294d51d31f92f983c70_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ottoopuk.exe"C:\Windows\system32\ottoopuk.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ottoopuk.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\eatdodar.exeFilesize
70KB
MD5291e5d1e8fb4e12780587fb95af7f091
SHA1c79223c1e3dba0d86f8b3d080f44066f65ba1465
SHA2561ffe0a238e6f865f22d5cecda1f88524bbe457ac9b64d4a367a67caaa6b6c74c
SHA512291c43e5c5f685fcb2cd39e264d14ea834ef9d36bf5e084f12abd4f725b45f73d8b647a549564e6363de4345ea596fc022b8cd50cf74ba2f3d009f430797cf3a
-
C:\Windows\SysWOW64\efreamet.exeFilesize
71KB
MD5f8f147a9b2e4e9f4d63e5dc4411c3adf
SHA1184025ddc29ee6f55caaa496019857531c642c1c
SHA256be420b552987ff5d095ed271d2c9097a3b884aa04a18f2a16c7dfc374feebfd4
SHA512c7695b5b75cdb7fd80ecd96e8f612a34077be7c24bf12d62573e25cd938cdd7b48b8df3ae92e69ab39996b63b792d50ad177f150bb6e92784ddfa38ae94dd6d8
-
C:\Windows\SysWOW64\ochanap.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
\Windows\SysWOW64\ottoopuk.exeFilesize
68KB
MD5e7f3d42975ea5294d51d31f92f983c70
SHA180f215e749df38a358999a0a723237d185eb7fe3
SHA256885295b4ae7dec735e28bf4347224844d5f57e08e758302e189ef80f2b203d8c
SHA512cd53c4681355b520ea92c8bc600f84f6ac94540a8841e98c89aee267e1fb5a6efebb513742884234cc9b22724a453ad16c70848b202e118f257f81f9da29340d
-
memory/1116-52-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1252-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2152-53-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB