Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe
-
Size
68KB
-
MD5
0f37db955c54c1b0cec4b42d71a53230
-
SHA1
6cfc9296e9d4222ed303bce9459477e4e5b4016f
-
SHA256
6dac70abe229f7585487d1ea017c76c5afa4dac3fcec0c0ccf50efb084da292c
-
SHA512
c780bb70241f1526dbb6ba503410df9e278acaa60ba4e7b1f6058aa3801461faa2958c2961c2df35276f4108cd1fcd59fd5dc16201ee8425b1dbd7f99c9402c7
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8U:Olg35GTslA5t3/w8U
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" agbupic.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\atgoatur-oudeas.exe" agbupic.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ixpihes-edom.exe" agbupic.exe -
Executes dropped EXE 2 IoCs
pid Process 2200 agbupic.exe 3756 agbupic.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" agbupic.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} agbupic.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ihlufoof.dll" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" agbupic.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ixpihes-edom.exe agbupic.exe File created C:\Windows\SysWOW64\ixpihes-edom.exe agbupic.exe File created C:\Windows\SysWOW64\atgoatur-oudeas.exe agbupic.exe File opened for modification C:\Windows\SysWOW64\ihlufoof.dll agbupic.exe File created C:\Windows\SysWOW64\ihlufoof.dll agbupic.exe File opened for modification C:\Windows\SysWOW64\agbupic.exe 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe File created C:\Windows\SysWOW64\agbupic.exe 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\atgoatur-oudeas.exe agbupic.exe File opened for modification C:\Windows\SysWOW64\agbupic.exe agbupic.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 3756 agbupic.exe 3756 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe 2200 agbupic.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1780 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe Token: SeDebugPrivilege 2200 agbupic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2200 1780 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 82 PID 1780 wrote to memory of 2200 1780 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 82 PID 1780 wrote to memory of 2200 1780 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 82 PID 2200 wrote to memory of 3756 2200 agbupic.exe 83 PID 2200 wrote to memory of 3756 2200 agbupic.exe 83 PID 2200 wrote to memory of 3756 2200 agbupic.exe 83 PID 2200 wrote to memory of 620 2200 agbupic.exe 5 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56 PID 2200 wrote to memory of 3484 2200 agbupic.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\agbupic.exe"C:\Windows\system32\agbupic.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\agbupic.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3756
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD50f37db955c54c1b0cec4b42d71a53230
SHA16cfc9296e9d4222ed303bce9459477e4e5b4016f
SHA2566dac70abe229f7585487d1ea017c76c5afa4dac3fcec0c0ccf50efb084da292c
SHA512c780bb70241f1526dbb6ba503410df9e278acaa60ba4e7b1f6058aa3801461faa2958c2961c2df35276f4108cd1fcd59fd5dc16201ee8425b1dbd7f99c9402c7
-
Filesize
70KB
MD515290b5127fe72bcfb1cf1ccedba2ba6
SHA19afcbe34b2a3ea1faefa42e0e7cc97498a578b51
SHA2562deb108f50ae47e3ee7d360bae941959ed0a6bcae862ff6c14f4d2457d875843
SHA5121fb769476182c834c82be95910c43fb60cb296809b58312b79d1fa1ccfc760db50d5969e4d4b52de61b1fc5986f6a699a45e7245bee7f47f74da4f78bf6f8afc
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD5e01ed0aaadc98941d0ab0ab6fc8d9cbd
SHA1a908b3de3ee65fc5b800199b9823bce194e43f0a
SHA2562998cd2a7c492f3e65a1a1329356dd7e32a401db0800801607faf916bb8ef502
SHA512d7de70b396830464b2c8840febc5ed26f373439d40511d2f7ac61577cb0395494cc81c83c5664eefa2fc946e9abf96e291d48f73f8cf6b3ff92d37e166de77c0