34cef50f98a5128e19d7890c0697cf80237cca0b08cce70918b37e296e58a068

Analysis

max time kernel
148s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
Size

463KB
MD5

7ef5ccd75f37751f17e72139c3fcfcb0
SHA1

5c03bd95680545fe16c587a97d60dbe55a4e8435
SHA256

34cef50f98a5128e19d7890c0697cf80237cca0b08cce70918b37e296e58a068
SHA512

64431f11c7cd59471b515686cf35837252f71697b09b89a4ff37624ab4e5c265081bf02e8e3e764755551238f870439b1312d5a7c7a3912e60aa48d312fb4a07
SSDEEP

12288:p1bP2fLlMvjIzvuScMOSGeZt/aayg7Pf0TOuwYbSjS:p1bPOuScMOGX9PAL1

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DC++ Share\mip.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX6384.tmp	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OSE.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\createdump.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\dotnet.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\dotnet.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ExtExport.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSE.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7ef5ccd75f37751f17e72139c3fcfcb0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
930KB

MD5
881a726e43b0ab13d683e6b479dd854c

SHA1
788c6cbd1f58c95caaaef19c1778ae1dc36e219b

SHA256
3b10c49dbb891e7f15031cef23296fac4bd33b9e34d66673102deb72809eaa1a

SHA512
b6fa3ac177aca011d331c273e068715937c4f763548f18e087f9b73b0e5e9f33244b7b5960720a5544a51694e05a13a434d548511bf78623ff737d3662e98983

Download Submit
memory/4928-20-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-21-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-22-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-23-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-24-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-26-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-27-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-28-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-30-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-32-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4928-104-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads