Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 22:12

General

  • Target

    285b26a0c32b245e09c954a1b650cc30_NeikiAnalytics.exe

  • Size

    70KB

  • MD5

    285b26a0c32b245e09c954a1b650cc30

  • SHA1

    7b6422594a620e7a65deb4a525645a4023231e2b

  • SHA256

    7767a3714085511fe9b117c3246fe5c8dab47f84040f401408ab5f3f398ca2f6

  • SHA512

    64a699d02637cd902d6945849e2c97809c01c98b6898b2c1df66ad72b80fe52baef650b124ec86143a0c16ab3e1575abea7305391b88e16c870e27cf50af0583

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slx:Olg35GTslA5t3/w8M

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3604
        • C:\Users\Admin\AppData\Local\Temp\285b26a0c32b245e09c954a1b650cc30_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\285b26a0c32b245e09c954a1b650cc30_NeikiAnalytics.exe"
          2⤵
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4656
          • C:\Windows\SysWOW64\ounhetik-ehex.exe
            "C:\Windows\system32\ounhetik-ehex.exe"
            3⤵
            • Windows security bypass
            • Modifies Installed Components in the registry
            • Sets file execution options in registry
            • Executes dropped EXE
            • Windows security modification
            • Modifies WinLogon
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2164
            • C:\Windows\SysWOW64\ounhetik-ehex.exe
              --k33p
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:5096

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\SysWOW64\eafhegid.exe

              Filesize

              73KB

              MD5

              d0c18e622454d529b971a869175ac0cb

              SHA1

              129ac88fef245bdf534dd00e8f7d9ef21adbf537

              SHA256

              818d199c6c304ad1577739bab4a2776562a25e350b62f0ed5e05620c5df67bee

              SHA512

              a329a9df69ed4547579bb1f967ec4abd889907d1968bb6f33d58c3ea0c82d4868483d1ddeedbaba0ea362dc2def59a430fdecd20fbae576d9a5ce47bc0127f80

            • C:\Windows\SysWOW64\eaxlabis.dll

              Filesize

              5KB

              MD5

              f37b21c00fd81bd93c89ce741a88f183

              SHA1

              b2796500597c68e2f5638e1101b46eaf32676c1c

              SHA256

              76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

              SHA512

              252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

            • C:\Windows\SysWOW64\ounhetik-ehex.exe

              Filesize

              70KB

              MD5

              285b26a0c32b245e09c954a1b650cc30

              SHA1

              7b6422594a620e7a65deb4a525645a4023231e2b

              SHA256

              7767a3714085511fe9b117c3246fe5c8dab47f84040f401408ab5f3f398ca2f6

              SHA512

              64a699d02637cd902d6945849e2c97809c01c98b6898b2c1df66ad72b80fe52baef650b124ec86143a0c16ab3e1575abea7305391b88e16c870e27cf50af0583

            • C:\Windows\SysWOW64\oupnoagim-eacex.exe

              Filesize

              74KB

              MD5

              92b52bf62783e1082a7a76d8db5006aa

              SHA1

              935054dc030b4fc5b67343cef1e8ef5832e07ec4

              SHA256

              d5512a93749209042e7efaa1f49e0fa547b9c5f6a539b9aec7cef080a9ace478

              SHA512

              83e175131385777cfd7ea627f398bcc1e22d388be09f39f4fbb0bbfe36299b169ca2824cd4e4c53a92f724ddee926edb2c4e37fc799d3eb022287a21eedbe9b7

            • memory/2164-49-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/4656-5-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/5096-50-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB