Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:47

General

  • Target

    5e5f9d40e9306bf5adaaadd7d4cd7b30_NeikiAnalytics.exe

  • Size

    1.4MB

  • MD5

    5e5f9d40e9306bf5adaaadd7d4cd7b30

  • SHA1

    9f88e814478f8f6cb5e36f7edad2521a626d971c

  • SHA256

    9d69a686fa761a2d7eae16ec8a6e09984e2ce5e5f1d69c24a60c10a260abea35

  • SHA512

    0bfa145eda550e37f0168ae77d23ed9737527f374183b59791a06739e89f04ec4de54ba0c2f2103fda4febea243b761b70700c85738fc7678db0612893a905d8

  • SSDEEP

    24576:S9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlMh:S9UX1uBx4mYo83vOSeyeaKrP

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e5f9d40e9306bf5adaaadd7d4cd7b30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5e5f9d40e9306bf5adaaadd7d4cd7b30_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:640
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2248
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2152
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2776
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:1828
          • C:\Windows\SysWOW64\at.exe
            at 03:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1436
            • C:\Windows\SysWOW64\at.exe
              at 03:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:388
              • C:\Windows\SysWOW64\at.exe
                at 03:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3116

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                1.4MB

                MD5

                ac67bb74cfef053718671663c638e56c

                SHA1

                d21600825503a6c8f46b6f1ee423698dde78d2ca

                SHA256

                402854af65692637af6d861b6169f86b1461487971a196dd8e2a9c4fb9c49c74

                SHA512

                b3248926e32e9ee1f1a11f52dcdaa05eedcd3dd9f20b976994d2bf3bb17d4acd552d22d859ddcd0d45d09f8ca21d46a190e2fda6237faf54a3aa7978df8becdc

              • C:\Windows\System\explorer.exe

                Filesize

                1.4MB

                MD5

                901088484360b9558f18a297571224fb

                SHA1

                9924881fe53431ce0cec83b9484f053c374b9261

                SHA256

                908102441fa0b010cdb727e87662724b197a653d1c059b1ff4554768b24b20bf

                SHA512

                1e9512894404e33508bcaca1ad8be8b3d701f858d15030b05f4cf17150874fe943d260dfe65b3bb935654109a2c3d22f15db081e53b9e102a6f8550e0d7bbe7b

              • C:\Windows\System\spoolsv.exe

                Filesize

                1.4MB

                MD5

                f5fef16332824dfe77ace4a098006a41

                SHA1

                9d8860c65775614db0244509883dcd245a9052c8

                SHA256

                13c5aea2bc6d35e440b1b9547306dd5429f817a3639737eaeea189b6c19bc346

                SHA512

                bfcab0602020fd11b8e137308d0fbf9ed9417ec02497e90d0b0e471d26ff66c15460a8a1cf5b6137615ba4144c8e1e9293e5d9122ff1f9a9d27567cc417d1b54

              • C:\Windows\System\svchost.exe

                Filesize

                1.4MB

                MD5

                323b77580b41b567d0177fa85858e7c9

                SHA1

                4bc761ca3c4d8f5c98b2957e8720c2ab65ae2ca6

                SHA256

                3067a2ced9b3991d5f76a324e7428f4b1e36d405a52dc083fc6ed0c2371ef4a4

                SHA512

                f8e19db42f6d81c57381ae9f3b11bbba5b225cda4bd498e80301390e3396f877ee252f81ec6403d8d0553166db08eb2dba509b25030be36748d9af9e2195ae06

              • memory/640-43-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/640-0-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/1828-32-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/1828-39-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2152-18-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2152-42-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2248-45-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2248-57-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2248-9-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2248-70-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2776-27-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2776-46-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB

              • memory/2776-52-0x0000000000400000-0x00000000009A0000-memory.dmp

                Filesize

                5.6MB