Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:24
Static task
static1
Behavioral task
behavioral1
Sample
a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
a69c9a69bbe789a53a77e8d56f6925c0
-
SHA1
0ee591f2e862794fa7fe3bdbd6fc6c3b24174213
-
SHA256
35ba2e4be66c765a79b4bc31d60b486619c26cd9fae3ded00c7aa1d1de664837
-
SHA512
740dc82e9e5b35f2e42f4bee30f6ce20fbddb9d923d61dfb2bec76d38b9127abd53e37ab48c0da05fb22710362340f900f8f5e35c9ddc7cfdfa52cda25d83a7c
-
SSDEEP
1536:vNVg8r8QOBcYhv7Kp3StjEMjmLM3ztDJWZsXy4JzxPM0:KBcYhvJJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
reiofe.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reiofe.exe -
Executes dropped EXE 1 IoCs
Processes:
reiofe.exepid process 2592 reiofe.exe -
Loads dropped DLL 2 IoCs
Processes:
a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exepid process 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reiofe.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiofe = "C:\\Users\\Admin\\reiofe.exe" reiofe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
reiofe.exepid process 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe 2592 reiofe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exereiofe.exepid process 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe 2592 reiofe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exereiofe.exedescription pid process target process PID 2344 wrote to memory of 2592 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe reiofe.exe PID 2344 wrote to memory of 2592 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe reiofe.exe PID 2344 wrote to memory of 2592 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe reiofe.exe PID 2344 wrote to memory of 2592 2344 a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe reiofe.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe PID 2592 wrote to memory of 2344 2592 reiofe.exe a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a69c9a69bbe789a53a77e8d56f6925c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\reiofe.exe"C:\Users\Admin\reiofe.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\reiofe.exeFilesize
53KB
MD5e5970a580429a094bff00bd71efb7b7a
SHA19ce4ba98751da1124486eed04e3e17746dbc338c
SHA256a574ab9c36a96b5043a903f984dbb67193fb82b40336503aa16910b41425bac5
SHA5122b2097e4c8da88c2fa81ea371ca53d373f61ed0c55102b0ecc7a9e46255638c1b9534aa50a39f327ffe43753ec6f7c81f4fd1e50a8736ae243ace7830d4bb780
-
memory/2344-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2344-15-0x0000000003720000-0x0000000003732000-memory.dmpFilesize
72KB
-
memory/2344-14-0x0000000003720000-0x0000000003732000-memory.dmpFilesize
72KB
-
memory/2592-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB