Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:47

General

  • Target

    5e5f9d40e9306bf5adaaadd7d4cd7b30_NeikiAnalytics.exe

  • Size

    1.4MB

  • MD5

    5e5f9d40e9306bf5adaaadd7d4cd7b30

  • SHA1

    9f88e814478f8f6cb5e36f7edad2521a626d971c

  • SHA256

    9d69a686fa761a2d7eae16ec8a6e09984e2ce5e5f1d69c24a60c10a260abea35

  • SHA512

    0bfa145eda550e37f0168ae77d23ed9737527f374183b59791a06739e89f04ec4de54ba0c2f2103fda4febea243b761b70700c85738fc7678db0612893a905d8

  • SSDEEP

    24576:S9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMh:S9UX1uBx4mYo83vOSeyeaKrP

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e5f9d40e9306bf5adaaadd7d4cd7b30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5e5f9d40e9306bf5adaaadd7d4cd7b30_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2008
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2316
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1992
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2728
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2588
          • C:\Windows\SysWOW64\at.exe
            at 03:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2412
            • C:\Windows\SysWOW64\at.exe
              at 03:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1536
              • C:\Windows\SysWOW64\at.exe
                at 03:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:440

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                1.4MB

                MD5

                321f1a447de668efc3557491c998e8ef

                SHA1

                9789c0ae06ec121a7c67f553362083fdb649ec7d

                SHA256

                84c9526b25f02f18890b79c2f721b080f0fcf6d26c8b01b270b5f2b0010dd1d8

                SHA512

                ccb1e3b997c9c9480c82c3c74ebb1e4b388d5603af6b020bde0b881bf890aca6158cfb10070caa32de5f3e53b22da5a1a4fee9c3cf0076a3e7b2cc1a63fc7f13

              • C:\Windows\system\explorer.exe

                Filesize

                1.4MB

                MD5

                6bc1dd6dc3e635e82613c47862b04d69

                SHA1

                79f7e50ba56d18979279a5a2b04a82128f77c85a

                SHA256

                868836515be7f499f4d3e9b643d223348ecae2c23ec10cd0f012273e26177110

                SHA512

                9645f7df6f5494d7a48615338150d813d29c44f47f02721b1923548d9a2823132c7b3b3c1cba32ec320909eb1a94e6cf6bd03810f5b1e81487c8ed5dbf27e11e

              • \Windows\system\spoolsv.exe

                Filesize

                1.4MB

                MD5

                d6a92b8a3eafd79da8e1556141a388f4

                SHA1

                1efcdb754db70da3cde18a1f851639f13a7a81f8

                SHA256

                004797910ab716a2d987756851c43acb3ce3b84dfe6c6e77bd77778a4c439381

                SHA512

                7d70167b3787b7f81bb64684de24d521a824e461fb4dc0f4777361f9256f3001ce70f4d664eb5077331eca322951f25e2c78c87216e410478202514f62af10ea

              • \Windows\system\svchost.exe

                Filesize

                1.4MB

                MD5

                4ac9fa1be402ec22175f0e82ca130615

                SHA1

                555214d110114ae88ad38035aed9c2cd6d736b23

                SHA256

                a6ca38d0bd9a8284fecf4f1709b22ced9b2382825f7f4aab50fc9c80f5edd413

                SHA512

                fc11498d23b41114655697797a5506f8707cf1d34a87cb1ea5333d80425c56552f3a0b5085537203e19cd9ce37d75a5d979e84d8796686af28570da13c1604dd

              • memory/1992-46-0x0000000004200000-0x00000000047A0000-memory.dmp

                Filesize

                5.6MB

              • memory/1992-66-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/1992-45-0x0000000004200000-0x00000000047A0000-memory.dmp

                Filesize

                5.6MB

              • memory/1992-30-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2008-16-0x0000000003F60000-0x0000000004500000-memory.dmp

                Filesize

                5.6MB

              • memory/2008-0-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2008-13-0x0000000003F60000-0x0000000004500000-memory.dmp

                Filesize

                5.6MB

              • memory/2008-68-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2316-29-0x00000000042C0000-0x0000000004860000-memory.dmp

                Filesize

                5.6MB

              • memory/2316-31-0x00000000042C0000-0x0000000004860000-memory.dmp

                Filesize

                5.6MB

              • memory/2316-70-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2316-83-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2316-21-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2588-62-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2588-56-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2728-55-0x0000000003C70000-0x0000000004210000-memory.dmp

                Filesize

                5.6MB

              • memory/2728-54-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2728-57-0x0000000003C70000-0x0000000004210000-memory.dmp

                Filesize

                5.6MB

              • memory/2728-71-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2728-74-0x0000000003C70000-0x0000000004210000-memory.dmp

                Filesize

                5.6MB

              • memory/2728-92-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB