Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe
- Size 1.2MB
- Sample240526-eghmfsea4w
- SHA256 e00159e0e28aeebd565e09e8e8c0dd21d84beded115682017401c4d1d542a84e
- MD5 5f8d0a3745d7872c5568fc466e200ce0
- SHA1 c872ec3801a8f59637d5a1519d1ea9dde3c5ada6
- SHA512 821269349ca6fbf01a73091e4b1908e24fba834dd81b7dd5506cafa0d4ab5de65400bc15af922248e4a3f39802161337a7c229864c5864551e7b9f440fd82458
- SSDEEP 24576:O2Jb8dYOBbunHBDSswM+v6UJ2LBdAdoYBHL/dfRV4Z:ht8YOBynH1wM+v6UJ2LQd7BHjdfW
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3108 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.tmp 3372 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm 5044 GOG.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\GOG = "C:\\Windows\\GOG.exe" GOG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GOG = "C:\\Windows\\GOG.exe" GOG.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened (read-only) \??\B: 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\GOG.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm File opened for modification C:\Windows\GOG.exe 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm File created C:\Windows\GOG.exe GOG.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" GOG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" GOG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4404 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe 4404 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe 5044 GOG.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4404 wrote to memory of 3372 4404 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe 91 PID 4404 wrote to memory of 3372 4404 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe 91 PID 4404 wrote to memory of 3372 4404 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe 91 PID 3372 wrote to memory of 5044 3372 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm 92 PID 3372 wrote to memory of 5044 3372 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm 92 PID 3372 wrote to memory of 5044 3372 5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.tmpC:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.tmp2⤵
- Executes dropped EXE
PID:3108
-
-
C:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mmC:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\GOG.exeC:\Windows\GOG.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.mm
- Size 202KB
- SHA256 c1a88368491827872ef9ebea74060ab3df5512e9d2a8c728ad8f385892cd690a
- MD5 fe7a74228b116173e4336a26c5d95b9a
- SHA1 28886eb410df99ff64bf82e7875fde3b0c9fb211
- SHA512 414e74f725c9cc4b940f4c7f8fbc623cf1b4b17c2b55d438777acd6d46e61e248dd8ed51263833ef24c74b33955e713a6f237ab0262a0b8d0d4338600351a0fe
- SSDEEP 3072:1As9EzdgAnEFJaJgb6CCAn2Ix2lOqMLZssem5WrkwyQC3ZDCKAr2UmSiyVQB64Ry:9azdMJb6CqIqOq2eJCdlSgyVQr1ju
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5f8d0a3745d7872c5568fc466e200ce0_NeikiAnalytics.tmp
- Size 1020KB
- SHA256 f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92
- MD5 b65d7344b0a7faa207d2e1a7adaafb60
- SHA1 755ad15b1745b0e730d658d4a92e2b754425b7db
- SHA512 f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22
- SSDEEP 24576:8OBbunHBDSswM+v6UJ2LBdAdoYBHL/dfRV4s:8OBynH1wM+v6UJ2LQd7BHjdfj
- MD5 SHA1 SHA512 SSDEEP