70730b25201f3c2700439693643ff2e624ccc3fa9421d8ba903b4d6b2c19d607

General

Target

2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
Size

70KB
MD5

2912b42c391fd3dc1b5e3574979163c0
SHA1

945292fd0f3ed69f7fa93512bcaaf9078ec9cd78
SHA256

70730b25201f3c2700439693643ff2e624ccc3fa9421d8ba903b4d6b2c19d607
SHA512

0afce5e8f1978d8b581c8abaf718063fa314fbcd1a5719ca2a8371931df40bba719005a0e03d17c544504309548a34177d21b558ac1c4be2a3bf9fbdd10f48c0
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8U:Olg35GTslA5t3/w8U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oubdebof.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oubdebof.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oubdebof.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}\StubPath = "C:\\Windows\\system32\\utmutub-deas.exe"	oubdebof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}	oubdebof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{53434647-4252-4254-5343-464742524254}\IsInstalled = "1"	oubdebof.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

oubdebof.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	oubdebof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	oubdebof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\erloocaf-utoab.exe"	oubdebof.exe

Executes dropped EXE 2 IoCs

Processes:

oubdebof.exeoubdebof.exe

pid process

2896 oubdebof.exe
2628 oubdebof.exe
Loads dropped DLL 3 IoCs

Processes:

2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exeoubdebof.exe

pid process

1964 2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
1964 2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
2896 oubdebof.exe

pid	process
1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
2896	oubdebof.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

oubdebof.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	oubdebof.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	oubdebof.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

oubdebof.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	oubdebof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	oubdebof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	oubdebof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ugconooc-icoot.dll"	oubdebof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	oubdebof.exe

Drops file in System32 directory 9 IoCs

Processes:

oubdebof.exe2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\oubdebof.exe	oubdebof.exe
File opened for modification	C:\Windows\SysWOW64\erloocaf-utoab.exe	oubdebof.exe
File created	C:\Windows\SysWOW64\erloocaf-utoab.exe	oubdebof.exe
File opened for modification	C:\Windows\SysWOW64\utmutub-deas.exe	oubdebof.exe
File opened for modification	C:\Windows\SysWOW64\ugconooc-icoot.dll	oubdebof.exe
File created	C:\Windows\SysWOW64\ugconooc-icoot.dll	oubdebof.exe
File opened for modification	C:\Windows\SysWOW64\oubdebof.exe	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\oubdebof.exe	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\utmutub-deas.exe	oubdebof.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

oubdebof.exeoubdebof.exe

pid	process
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2628	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe
2896	oubdebof.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exeoubdebof.exe

description pid process

Token: SeDebugPrivilege 1964 2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
Token: SeDebugPrivilege 2896 oubdebof.exe

description	pid	process
Token: SeDebugPrivilege	1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2896	oubdebof.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exeoubdebof.exe

description	pid	process	target process
PID 1964 wrote to memory of 2896	1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe	oubdebof.exe
PID 1964 wrote to memory of 2896	1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe	oubdebof.exe
PID 1964 wrote to memory of 2896	1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe	oubdebof.exe
PID 1964 wrote to memory of 2896	1964	2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe	oubdebof.exe
PID 2896 wrote to memory of 436	2896	oubdebof.exe	winlogon.exe
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 2628	2896	oubdebof.exe	oubdebof.exe
PID 2896 wrote to memory of 2628	2896	oubdebof.exe	oubdebof.exe
PID 2896 wrote to memory of 2628	2896	oubdebof.exe	oubdebof.exe
PID 2896 wrote to memory of 2628	2896	oubdebof.exe	oubdebof.exe
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE
PID 2896 wrote to memory of 1352	2896	oubdebof.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1352

C:\Users\Admin\AppData\Local\Temp\2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2912b42c391fd3dc1b5e3574979163c0_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\oubdebof.exe
"C:\Windows\system32\oubdebof.exe"
3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\oubdebof.exe
--k33p
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\erloocaf-utoab.exe
Filesize
74KB

MD5
6a0087b98079b7d93b3704a5f8b203d8

SHA1
7f30efa6cc580edd00e9c454045ac4d6d842d42e

SHA256
6ec98055849509a2347cf35ec87132065ed2a68bd0ae425559d5ec545d7fb5c1

SHA512
3e0e4fc692ba205fb4ee30a19d30e0ee094364c289d51d2cf2381495a022a90dacf1c0f142abb7b9876a49d8124ecebf3c85160fc9a8c9d5900b15dcab64e83c

Download Submit
C:\Windows\SysWOW64\ugconooc-icoot.dll
Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\utmutub-deas.exe
Filesize
73KB

MD5
097b887f7cc4db59b9bd40638432bab7

SHA1
30235ae6a2d5acf4eb50624fdfb7a450e6d07e5d

SHA256
88da3d3e1210acc2548eaf5db606f42ff227eac40d5b695cb5f02c7fed956e33

SHA512
7b1ff0aeaf0069645bfe862280132879bf8fcb805fa520549783edb6ecde2e0d2bbcb577838a766304fc5bb14bc94eb22b893382695b13aec7e9dd499bb9fac8

Download Submit
\Windows\SysWOW64\oubdebof.exe
Filesize
70KB

MD5
2912b42c391fd3dc1b5e3574979163c0

SHA1
945292fd0f3ed69f7fa93512bcaaf9078ec9cd78

SHA256
70730b25201f3c2700439693643ff2e624ccc3fa9421d8ba903b4d6b2c19d607

SHA512
0afce5e8f1978d8b581c8abaf718063fa314fbcd1a5719ca2a8371931df40bba719005a0e03d17c544504309548a34177d21b558ac1c4be2a3bf9fbdd10f48c0

Download Submit
memory/1964-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2628-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2896-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads