ebb8f40ced7bc2272ef320188049ca5e08e33ef6d9847185d784a27b3846d70e

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe
Size 504KB
Sample240524-we3naaec24
SHA256 ebb8f40ced7bc2272ef320188049ca5e08e33ef6d9847185d784a27b3846d70e
MD5 f1f0bc22079b5b2b33ec560b0a64c330
SHA1 216fe91a2916660d82ce58357f40ef05992b5d1e
SHA512 8c6b35a5292f79d234e873fb2514254ee881471058db4910cd51dd2696d2ab61f71110118cd2f192512ec06f25d58ac641418608212ed26f50e26ca1913b4e48
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3552	Explorrer.exe
4380	Explorrer.exe
2220	Explorrer.exe

Loads dropped DLL 2 IoCs

pid	Process
5080	regsvr32.exe
1996	regsvr32.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5040-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/5040-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/5040-14-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/files/0x0008000000023266-18.dat	upx
behavioral2/memory/3552-20-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/3552-26-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/3552-28-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/3552-42-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\NoExplorer = "1"	regsvr32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 3552 set thread context of 4380	3552	Explorrer.exe	101
PID 3552 set thread context of 2220	3552	Explorrer.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4280	3620	WerFault.exe	103

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3620	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Approved Extensions	Explorrer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{3543619C-D563-43f7-95EA-4DA7E1CC396A} = 51667a6c4c1d3b1b003ad2d87fc9ac0780c431c2a3933e7f	Explorrer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\ = "IE MANAGER"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\IE\\bho.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe
2796	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe
3552	Explorrer.exe
4380	Explorrer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2796	5040	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	98
PID 2796 wrote to memory of 3552	2796	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	99
PID 2796 wrote to memory of 3552	2796	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	99
PID 2796 wrote to memory of 3552	2796	f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe	99
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 4380	3552	Explorrer.exe	101
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 3552 wrote to memory of 2220	3552	Explorrer.exe	102
PID 4380 wrote to memory of 3620	4380	Explorrer.exe	103
PID 4380 wrote to memory of 3620	4380	Explorrer.exe	103
PID 4380 wrote to memory of 3620	4380	Explorrer.exe	103
PID 4380 wrote to memory of 3620	4380	Explorrer.exe	103
PID 4380 wrote to memory of 3620	4380	Explorrer.exe	103
PID 2220 wrote to memory of 5080	2220	Explorrer.exe	108
PID 2220 wrote to memory of 5080	2220	Explorrer.exe	108
PID 2220 wrote to memory of 5080	2220	Explorrer.exe	108
PID 2220 wrote to memory of 1996	2220	Explorrer.exe	109
PID 2220 wrote to memory of 1996	2220	Explorrer.exe	109
PID 2220 wrote to memory of 1996	2220	Explorrer.exe	109

C:\Users\Admin\AppData\Local\Temp\f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\f1f0bc22079b5b2b33ec560b0a64c330_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
    C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:3620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 272
        6⤵
        Program crash
        
        PID:4280
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        
        PID:5080
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Modifies registry class
        
        PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3620 -ip 3620
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorrer.exe

Path C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
Size 504KB
SHA256 a94fd1ea0cbf62f791ca06d5f76b7bf87bafcc03ae66aed3fff4a6c3e1428a6e
MD5 196d813dcd973d8c67226f6bc536269b
SHA1 dcf076ee2b0222754d52b3457f856d365cb8ca02
SHA512 682e283c267bb80a43e7816aef568927a811f890b677cbb56bf86139303abf5bb98b27aa997e561aa9287e982340e457194ca4b6bededfa52b0dd314e195290f
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bho.dll

Path C:\Users\Admin\AppData\Roaming\IE\bho.dll
Size 87KB
SHA256 976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5
MD5 49a92a33d1775b45b3bd45f8bec24585
SHA1 ea404af50bbdad5cbc9f95f4068bdc30c9fceff6
SHA512 7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f
SSDEEP 1536:ETw4mDklLqIaqhQ2MQXDn0Nzy8XTgUYV6uSXyV29fS1SWeITo:EmCLHaqWQXDn0NzutNtV29fS1HeITo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2220-91-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-64-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-169-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-58-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-59-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-60-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-61-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-62-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-63-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-65-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-66-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-33-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-36-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-49-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-50-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-48-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-47-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-46-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-45-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-44-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-43-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-41-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-67-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-35-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-51-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-89-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-80-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-77-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-74-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-94-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-93-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-92-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-68-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-90-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-69-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-70-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-88-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-87-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-86-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-85-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-84-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-83-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-82-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-81-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-78-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-79-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-76-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-75-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-73-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-72-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2220-71-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2796-11-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2796-23-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2796-9-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2796-24-0x0000000000410000-0x00000000004D9000-memory.dmp

Download

memory/2796-25-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3552-20-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3552-42-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3552-28-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3552-26-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4380-164-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/5040-6-0x0000000004480000-0x0000000004481000-memory.dmp

Download

memory/5040-5-0x0000000002310000-0x0000000002311000-memory.dmp

Download

memory/5040-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/5040-3-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/5040-7-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download

memory/5040-8-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/5040-14-0x0000000000400000-0x000000000049C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads