Analysis
-
max time kernel
129s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 12:32
Behavioral task
behavioral1
Sample
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe
-
Size
42KB
-
MD5
1bb2bacdb755855e8a2128cedc6d7250
-
SHA1
de349e4d0eefee92c156f56d68d4b6e58e514b79
-
SHA256
7a92a055b629f17ccddca003721e049e225c6dd3af2612b747759ecfea768c4c
-
SHA512
b081f23385fd61bc1750292ca8b9423734753ec675050a8e9ec549c7a644da0f951e36d47026299ecf410a078dc131ee5f715ad3e39f054b1a9a54a2cc054888
-
SSDEEP
768:wzB/kjjhA5IdqAzOetP5krjpOF5PG9yCyOwhI3EicF:wt/4S5I06OEkIFI9yTOwaFcF
Malware Config
Extracted
xworm
5.0
related-bc.gl.at.ply.gg:57814
ozjnmdl7QQRysNhZ
-
Install_directory
%AppData%
-
install_file
Chrome.exe
-
telegram
https://api.telegram.org/bot7032462376:AAGAWT6TSWWn2-0FHv2b72CVFdIJ778FU8I/sendMessage?chat_id=797230345
Signatures
-
Detect Xworm Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-1-0x0000000000E30000-0x0000000000E40000-memory.dmp family_xworm C:\Users\Admin\AppData\Roaming\Chrome.exe family_xworm behavioral1/memory/1272-13-0x0000000000EE0000-0x0000000000EF0000-memory.dmp family_xworm behavioral1/memory/1852-15-0x00000000001C0000-0x00000000001D0000-memory.dmp family_xworm -
Drops startup file 2 IoCs
Processes:
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.lnk 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
Processes:
Chrome.exeChrome.exepid process 1272 Chrome.exe 1852 Chrome.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\Chrome.exe" 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exepid process 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exeChrome.exeChrome.exedescription pid process Token: SeDebugPrivilege 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe Token: SeDebugPrivilege 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe Token: SeDebugPrivilege 1272 Chrome.exe Token: SeDebugPrivilege 1852 Chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exepid process 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exetaskeng.exedescription pid process target process PID 1736 wrote to memory of 2924 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe schtasks.exe PID 1736 wrote to memory of 2924 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe schtasks.exe PID 1736 wrote to memory of 2924 1736 1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe schtasks.exe PID 2160 wrote to memory of 1272 2160 taskeng.exe Chrome.exe PID 2160 wrote to memory of 1272 2160 taskeng.exe Chrome.exe PID 2160 wrote to memory of 1272 2160 taskeng.exe Chrome.exe PID 2160 wrote to memory of 1852 2160 taskeng.exe Chrome.exe PID 2160 wrote to memory of 1852 2160 taskeng.exe Chrome.exe PID 2160 wrote to memory of 1852 2160 taskeng.exe Chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1bb2bacdb755855e8a2128cedc6d7250_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\Admin\AppData\Roaming\Chrome.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {531414A2-B96C-4DE0-AEDD-8FA31A318D53} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Chrome.exeC:\Users\Admin\AppData\Roaming\Chrome.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Chrome.exeC:\Users\Admin\AppData\Roaming\Chrome.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Chrome.exeFilesize
42KB
MD51bb2bacdb755855e8a2128cedc6d7250
SHA1de349e4d0eefee92c156f56d68d4b6e58e514b79
SHA2567a92a055b629f17ccddca003721e049e225c6dd3af2612b747759ecfea768c4c
SHA512b081f23385fd61bc1750292ca8b9423734753ec675050a8e9ec549c7a644da0f951e36d47026299ecf410a078dc131ee5f715ad3e39f054b1a9a54a2cc054888
-
memory/1272-13-0x0000000000EE0000-0x0000000000EF0000-memory.dmpFilesize
64KB
-
memory/1736-0-0x000007FEF5953000-0x000007FEF5954000-memory.dmpFilesize
4KB
-
memory/1736-1-0x0000000000E30000-0x0000000000E40000-memory.dmpFilesize
64KB
-
memory/1736-2-0x000007FEF5950000-0x000007FEF633C000-memory.dmpFilesize
9.9MB
-
memory/1736-7-0x000007FEF5953000-0x000007FEF5954000-memory.dmpFilesize
4KB
-
memory/1736-8-0x000007FEF5950000-0x000007FEF633C000-memory.dmpFilesize
9.9MB
-
memory/1852-15-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB