Analysis
-
max time kernel
93s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
26-05-2024 17:09
General
-
Target
16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe
-
Size
463KB
-
MD5
16e3d92f16e9ccc3752437a114d82ac0
-
SHA1
a06991b8c646fd262b241f34f8613f478228fac6
-
SHA256
ad7053f43a80b0565bf8939f6e65eb0387d5bca3a22ec2e217e0a027beeb8d54
-
SHA512
b008d3d738ebb18cac46e524398b1fae3dd2ca1d8640748158d1b1b7ac44a500c5e3345c6b9cc8ae720326c67bf7e464a88a287c858f96b16a6824c8b37ad633
-
SSDEEP
12288:5NUhiHOR4mucvSFSrux88ndNtJXzLFziVbs0:LUhiHOeB8rin3thLof
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"3⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Adobe\ARM\ArmReport.iniFilesize
746B
MD55757246b0746f04f7c6c7685c433d80f
SHA1910a75876285c35fe0fa03c11f36257aeba8a2b3
SHA256d33f7174ff6e717d72bfb38cf92e25135823d3d02273bf3f575f95d2afdc12dc
SHA5128f2f3642154d4f016f7679567cc5879e8d4a794a07b62b9663905406a77aebb111b04032353588719a631d9e5223acf543499ef7f7b36e0e15ec966c638219f4
-
C:\Users\Admin\AppData\Local\Temp\AdobeARM.logFilesize
178B
MD5326c575f82f5c870c37a4368fe7c7d30
SHA1b0a6a907326b2f6159726273a6edfd890437f760
SHA256f72c165ff778a0f48489500d27de65979c33156561f9ab0dd6a69cfaea9318f3
SHA512e86afc0296cf32f0059201ca60cb6fe7c54bfe073a8b6941baa218ff92906d5ecd80d61883ecc89c21eb1ce81619e43a0b5fe10699439684267231127602a958
-
C:\Users\Admin\AppData\Local\Temp\ArmUI.iniFilesize
251KB
MD5864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA256b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
SHA512ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
-
C:\Users\Admin\AppData\Local\Temp\Tmp6428.tmpFilesize
3KB
MD5bbb796dd2b53f7fb7ce855bb39535e2f
SHA1dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA256ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
SHA5120d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
-
C:\Users\Admin\AppData\Local\Temp\Tmp7D40.tmpFilesize
3KB
MD5ec946860cff4f4a6d325a8de7d6254d2
SHA17c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA25619fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
SHA51238a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
-
C:\Users\Admin\AppData\Local\Temp\Tmp7D61.tmpFilesize
3KB
MD5fc2430057cb1be74c788f10c2d4540c8
SHA1cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA256dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
SHA5124e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
-
C:\Users\Admin\AppData\Local\Temp\Tmp7F84.tmpFilesize
3KB
MD5a58599260c64cb41ed7d156db8ac13ef
SHA1fb9396eb1270e9331456a646ebf1419fc283dc06
SHA256aabf92089e16fdb28706356dbc4efb5a81f5277946f2e67695b31676616ed2d2
SHA5126970cbc42e7ec64ccdb8e5633b7017b1e9ec0d4ad094869e221e9275b814b1442b84827996190159543bdb5e86df6885c45197c533d657db4660fca8ad761a71
-
memory/8-13-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-6-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-14-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-21-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-28-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/8-16-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-17-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-7-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-0-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/8-15-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-1-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-5-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB
-
memory/8-3-0x0000000002420000-0x00000000034DA000-memory.dmpFilesize
16.7MB