Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 19:37
Behavioral task
behavioral1
Sample
24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe
-
Size
557KB
-
MD5
24293fe80890219d6ba375e03e21bbf0
-
SHA1
3aaa33d198e60250a4388151ff239962aacdc682
-
SHA256
559a6a1ccb011d72d64859dff39acd52676c63aa8632d13085e86d7ae294b9b9
-
SHA512
58f7de5163ec05f275f4c93c9d80354e2b581e021ebcbcf891257a09d0ae6f97ead80555f75ffe0b58738b6faa58021e0789fe09fcd72ab94bfd4ff4305a2678
-
SSDEEP
6144:056wsbR5sev/aggS/iwOaT2f1fXWxh17u3UVwcYD/IYAOy8eOlDQVSFjBLhqUBrs:DworvppqRU1CqWgRm9DzjB1qUF4K
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://5.42.96.117/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
plo7udsa2s
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
syslmgrsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" syslmgrsvc.exe -
Phorphiex payload 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\334958321.exe family_phorphiex \Users\Admin\AppData\Local\Temp\2162021571.exe family_phorphiex -
Processes:
syslmgrsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslmgrsvc.exe -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
19C8.exe334958321.exesyslmgrsvc.exe2712417633.exe2162021571.exe11926235.exeWindows Security Upgrade Service.exe146730178.exe1176623375.exepid process 2220 19C8.exe 2636 334958321.exe 2696 syslmgrsvc.exe 2756 2712417633.exe 2084 2162021571.exe 2868 11926235.exe 3028 Windows Security Upgrade Service.exe 1764 146730178.exe 2008 1176623375.exe -
Loads dropped DLL 11 IoCs
Processes:
24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe19C8.exesyslmgrsvc.exe11926235.exe146730178.exepid process 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe 2220 19C8.exe 2220 19C8.exe 2696 syslmgrsvc.exe 2696 syslmgrsvc.exe 2696 syslmgrsvc.exe 2696 syslmgrsvc.exe 2696 syslmgrsvc.exe 2868 11926235.exe 2696 syslmgrsvc.exe 1764 146730178.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x00000000005B3DB0-memory.dmp upx behavioral1/memory/1972-28-0x0000000000400000-0x00000000005B3DB0-memory.dmp upx behavioral1/memory/1972-41-0x0000000000400000-0x00000000005B3DB0-memory.dmp upx -
Processes:
syslmgrsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslmgrsvc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
334958321.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syslmgrsvc.exe" 334958321.exe -
Drops file in Windows directory 2 IoCs
Processes:
334958321.exedescription ioc process File created C:\Windows\syslmgrsvc.exe 334958321.exe File opened for modification C:\Windows\syslmgrsvc.exe 334958321.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe19C8.exe334958321.exesyslmgrsvc.exe11926235.exe146730178.exedescription pid process target process PID 1972 wrote to memory of 2220 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe 19C8.exe PID 1972 wrote to memory of 2220 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe 19C8.exe PID 1972 wrote to memory of 2220 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe 19C8.exe PID 1972 wrote to memory of 2220 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe 19C8.exe PID 2220 wrote to memory of 2636 2220 19C8.exe 334958321.exe PID 2220 wrote to memory of 2636 2220 19C8.exe 334958321.exe PID 2220 wrote to memory of 2636 2220 19C8.exe 334958321.exe PID 2220 wrote to memory of 2636 2220 19C8.exe 334958321.exe PID 2636 wrote to memory of 2696 2636 334958321.exe syslmgrsvc.exe PID 2636 wrote to memory of 2696 2636 334958321.exe syslmgrsvc.exe PID 2636 wrote to memory of 2696 2636 334958321.exe syslmgrsvc.exe PID 2636 wrote to memory of 2696 2636 334958321.exe syslmgrsvc.exe PID 1972 wrote to memory of 2480 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe splwow64.exe PID 1972 wrote to memory of 2480 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe splwow64.exe PID 1972 wrote to memory of 2480 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe splwow64.exe PID 1972 wrote to memory of 2480 1972 24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe splwow64.exe PID 2696 wrote to memory of 2756 2696 syslmgrsvc.exe 2712417633.exe PID 2696 wrote to memory of 2756 2696 syslmgrsvc.exe 2712417633.exe PID 2696 wrote to memory of 2756 2696 syslmgrsvc.exe 2712417633.exe PID 2696 wrote to memory of 2756 2696 syslmgrsvc.exe 2712417633.exe PID 2696 wrote to memory of 2084 2696 syslmgrsvc.exe 2162021571.exe PID 2696 wrote to memory of 2084 2696 syslmgrsvc.exe 2162021571.exe PID 2696 wrote to memory of 2084 2696 syslmgrsvc.exe 2162021571.exe PID 2696 wrote to memory of 2084 2696 syslmgrsvc.exe 2162021571.exe PID 2696 wrote to memory of 2868 2696 syslmgrsvc.exe 11926235.exe PID 2696 wrote to memory of 2868 2696 syslmgrsvc.exe 11926235.exe PID 2696 wrote to memory of 2868 2696 syslmgrsvc.exe 11926235.exe PID 2696 wrote to memory of 2868 2696 syslmgrsvc.exe 11926235.exe PID 2868 wrote to memory of 3028 2868 11926235.exe Windows Security Upgrade Service.exe PID 2868 wrote to memory of 3028 2868 11926235.exe Windows Security Upgrade Service.exe PID 2868 wrote to memory of 3028 2868 11926235.exe Windows Security Upgrade Service.exe PID 2868 wrote to memory of 3028 2868 11926235.exe Windows Security Upgrade Service.exe PID 2696 wrote to memory of 1764 2696 syslmgrsvc.exe 146730178.exe PID 2696 wrote to memory of 1764 2696 syslmgrsvc.exe 146730178.exe PID 2696 wrote to memory of 1764 2696 syslmgrsvc.exe 146730178.exe PID 2696 wrote to memory of 1764 2696 syslmgrsvc.exe 146730178.exe PID 1764 wrote to memory of 2008 1764 146730178.exe 1176623375.exe PID 1764 wrote to memory of 2008 1764 146730178.exe 1176623375.exe PID 1764 wrote to memory of 2008 1764 146730178.exe 1176623375.exe PID 1764 wrote to memory of 2008 1764 146730178.exe 1176623375.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24293fe80890219d6ba375e03e21bbf0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19C8.exe"C:\Users\Admin\AppData\Local\Temp\19C8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\334958321.exeC:\Users\Admin\AppData\Local\Temp\334958321.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\syslmgrsvc.exeC:\Windows\syslmgrsvc.exe4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2712417633.exeC:\Users\Admin\AppData\Local\Temp\2712417633.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2162021571.exeC:\Users\Admin\AppData\Local\Temp\2162021571.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11926235.exeC:\Users\Admin\AppData\Local\Temp\11926235.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\146730178.exeC:\Users\Admin\AppData\Local\Temp\146730178.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1176623375.exeC:\Users\Admin\AppData\Local\Temp\1176623375.exe6⤵
- Executes dropped EXE
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4LR3RN42\2[1]Filesize
80KB
MD52ff2bb06682812eeb76628bfbe817fbb
SHA118e86614d0f4904e1fe97198ccda34b25aab7dae
SHA256985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d
SHA5125cd3b5a1e16202893b08c0ae70d3bcd9e7a49197ebf1ded08e01395202022b3b6c2d8837196ef0415fea6497d928b44e03544b934f8e062ddbb6c6f79fb6f440
-
\Users\Admin\AppData\Local\Temp\1176623375.exeFilesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
\Users\Admin\AppData\Local\Temp\11926235.exeFilesize
10KB
MD547340d40e7f73e62cf09ac60fd16ad68
SHA1effd38f6561155802d3e5090f5714589eae5ce6e
SHA256e8a0c46342abd882318dbfdb17b7d3cb93d7138564878a15c5b91229ed81689c
SHA5122d5fbacad67eba3c42c2be95c3bf64d787d15cf96d5afe827d6f9bdb175295859e684202ff5afc773202f4b9d0b3135e913c997bbe72026cd7a7ca96ecf5aa08
-
\Users\Admin\AppData\Local\Temp\146730178.exeFilesize
10KB
MD5c8cf446ead193a3807472fbd294c5f23
SHA12162f28c919222f75ce5f52e4bb1155255ae5368
SHA256e5d12658a690c62af7d4fc7b26735affc7210e3bfb6b2241de1bf90aebdc0717
SHA512fc94014fabf204ecd57990db4b05b81cbda0a314b621cbfa755296ddf5493ec55fb129d12eff5f92863d9f1d7fea679dc2aeb62baf898791448cb4fe34b595c1
-
\Users\Admin\AppData\Local\Temp\19C8.exeFilesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
\Users\Admin\AppData\Local\Temp\2162021571.exeFilesize
93KB
MD512cef7fbc69031169590a9b8d548c441
SHA19222e30ad87c768f14c1878e3c311ff70d0adf74
SHA25677673e3d8435c4d156f9f7b7e0a23d1eb632c59d75ac397e41fa8f9564dca573
SHA5123020dc6c7c847f88e3d0cb6cfd50404aadb1d2b795ed27aeab14540b330c1824ee2352e2912b4e8110ef17d3ffa85919662b07f9e11b5c0b6ec32be4d9962a2d
-
\Users\Admin\AppData\Local\Temp\334958321.exeFilesize
93KB
MD5a318cc45e79498b93e40d5e5b9b76be4
SHA14ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5
SHA2564b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2
SHA5123131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c
-
\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exeFilesize
20KB
MD5de36bc2bfc3c67820ebd75c912fadc3d
SHA138bd51e1052ae5bede5293827e87d6f494b204c8
SHA2562a5083d6e55f5cb56764fc4ed7ad082a0ef75a908ed03132178cc80f802c3d16
SHA512efbc8a797e95f00c142c4c02c2f3faf4f46fabcdcd1a99d81df7581244a22f0b81f846d15de3b5f4b6d323deff555fd569db57aff3171ffebf27c03e4d53e6ef
-
memory/1972-44-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/1972-41-0x0000000000400000-0x00000000005B3DB0-memory.dmpFilesize
1.7MB
-
memory/1972-28-0x0000000000400000-0x00000000005B3DB0-memory.dmpFilesize
1.7MB
-
memory/1972-0-0x0000000000400000-0x00000000005B3DB0-memory.dmpFilesize
1.7MB
-
memory/1972-9-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB