Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:07
Static task
static1
Behavioral task
behavioral1
Sample
a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe
-
Size
56KB
-
MD5
a33b46b7c628e52c7fbc0ef72f05d550
-
SHA1
4de7400424082fee4e1cdadea88fdc3c13c4fa26
-
SHA256
b4e866f83a90ec653b6634f16c7928a657c911d2bbf5877fa5250cc83143ec24
-
SHA512
f8f062d5ec68f3fd665143bfbef38bbf0bbc92b6674faa97ae728ff3edcdd1343cec7b45d4625486e2277e011d33fd73a3f835d7f67bf565cf6113382eec131c
-
SSDEEP
768:/1Em9rqSXFgsmfsmT3/M/iLCJXeXlXsX3XKnHYkcUckZ+9w98kMEk71y:NxXePD8HOXlXsX3XnkcUckD98kMEk7E
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
hiouh.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hiouh.exe -
Executes dropped EXE 1 IoCs
Processes:
hiouh.exepid process 1984 hiouh.exe -
Loads dropped DLL 2 IoCs
Processes:
a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exepid process 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
hiouh.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\hiouh = "C:\\Users\\Admin\\hiouh.exe" hiouh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hiouh.exepid process 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe 1984 hiouh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exehiouh.exepid process 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe 1984 hiouh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exehiouh.exedescription pid process target process PID 2012 wrote to memory of 1984 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe hiouh.exe PID 2012 wrote to memory of 1984 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe hiouh.exe PID 2012 wrote to memory of 1984 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe hiouh.exe PID 2012 wrote to memory of 1984 2012 a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe hiouh.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe PID 1984 wrote to memory of 2012 1984 hiouh.exe a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a33b46b7c628e52c7fbc0ef72f05d550_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\hiouh.exe"C:\Users\Admin\hiouh.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\hiouh.exeFilesize
56KB
MD54c2c09fc5889da321154b7718be28cba
SHA1d038ab433e3b3989d80eb6126c60f181085dbe28
SHA256640a047dd249b07476eb3bddcbfa9deddec26be8e70a2b24f5b2086a89521578
SHA51235a844acd53caf25c479fcbd2b1db7ccf6014e3b5d2bb024fe5c2d29891f999b1ff02b93681a14d31be30f5e24b400c48683cb52b90dabe89536d01c5bae1571