Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 22:12

General

  • Target

    285b26a0c32b245e09c954a1b650cc30_NeikiAnalytics.exe

  • Size

    70KB

  • MD5

    285b26a0c32b245e09c954a1b650cc30

  • SHA1

    7b6422594a620e7a65deb4a525645a4023231e2b

  • SHA256

    7767a3714085511fe9b117c3246fe5c8dab47f84040f401408ab5f3f398ca2f6

  • SHA512

    64a699d02637cd902d6945849e2c97809c01c98b6898b2c1df66ad72b80fe52baef650b124ec86143a0c16ab3e1575abea7305391b88e16c870e27cf50af0583

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slx:Olg35GTslA5t3/w8M

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:436
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1192
        • C:\Users\Admin\AppData\Local\Temp\285b26a0c32b245e09c954a1b650cc30_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\285b26a0c32b245e09c954a1b650cc30_NeikiAnalytics.exe"
          2⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2176
          • C:\Windows\SysWOW64\ounhetik-ehex.exe
            "C:\Windows\system32\ounhetik-ehex.exe"
            3⤵
            • Windows security bypass
            • Modifies Installed Components in the registry
            • Sets file execution options in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Modifies WinLogon
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:860
            • C:\Windows\SysWOW64\ounhetik-ehex.exe
              --k33p
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1284

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\SysWOW64\eafhegid.exe

              Filesize

              73KB

              MD5

              7cfdf93c021cea231f8c32c9d20baaf1

              SHA1

              707e815f71eb70684b0dde4a4dd4b488bec21f3f

              SHA256

              0c8abc190791d035c46f556cf1bc51c42da904985fde8b940609b51bff533c70

              SHA512

              5a033a4e6a1fccf1853f38ca57cb6a238c80ce877235996527b699e27ac67880b838df611af908a3e48c2216c9eaf5ec777f63a47700cd6334f7dbbdf54f1508

            • C:\Windows\SysWOW64\eaxlabis.dll

              Filesize

              5KB

              MD5

              f37b21c00fd81bd93c89ce741a88f183

              SHA1

              b2796500597c68e2f5638e1101b46eaf32676c1c

              SHA256

              76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

              SHA512

              252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

            • C:\Windows\SysWOW64\oupnoagim-eacex.exe

              Filesize

              74KB

              MD5

              75f16d8c7814a1e91206e150ce761e5b

              SHA1

              d80804e5658abd7889593502cd91ab60f4e62c7f

              SHA256

              845bbe6756c69459e8d49169ad1e9c4062d414cd939fd7768089ffd76808e396

              SHA512

              c4ebbaac844229e523d6e49096c469a8983dce60ea52e9c506e6a618c2efaf6db0da26a4577ecb45890df2c9359dbd5e7195ded0b68d9e3668e793b975c07124

            • \Windows\SysWOW64\ounhetik-ehex.exe

              Filesize

              70KB

              MD5

              285b26a0c32b245e09c954a1b650cc30

              SHA1

              7b6422594a620e7a65deb4a525645a4023231e2b

              SHA256

              7767a3714085511fe9b117c3246fe5c8dab47f84040f401408ab5f3f398ca2f6

              SHA512

              64a699d02637cd902d6945849e2c97809c01c98b6898b2c1df66ad72b80fe52baef650b124ec86143a0c16ab3e1575abea7305391b88e16c870e27cf50af0583

            • memory/860-55-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/1284-56-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/2176-9-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB