Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 17:48
Static task
static1
Behavioral task
behavioral1
Sample
19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe
-
Size
691KB
-
MD5
19df4a6e35fc54bd0afb078f875b9690
-
SHA1
3d22765346d1eba931a490082f36c90136018c05
-
SHA256
74c4d6a99f78d9829a76d6c59656f76c6e8a0087baab2a1395d31f4b6522b27e
-
SHA512
d1723e3c48d3f8c5a4023dfd22e1f120af5648021aeebd9c1425d0319e87c1decf62d77d3c299da9932a22009af2d8f45356136d2e679ca8c281b6efb40ce273
-
SSDEEP
12288:MWOTNXc3RounBAFnSS2/5hDiE+Xd3OWsN8/uOC5Ix8L+DLXsX9CpCB2:L3auBqSSSrDTm3WerC5W8ssf2
Malware Config
Extracted
formbook
4.1
bp31
hp68b.top
rajawali99pkv.com
cisseoriginals.com
pedchain.com
affibook.com
nudtnrg.com
lems.cloud
tipozaa.store
theamalliance.com
massalit.com
houysdegsesag.top
eseventplanning.com
wxt82.xyz
supportonlineinfo.online
genee.store
nohu247.pro
cartx.store
acomunicacaorestaura.store
249b871ab7d2.info
surantools.com
funlazio.info
lynktag.com
turdfi.xyz
libgeninfo.com
smartagriafrica.info
nikkisellshouses2.com
natsellsatl.com
pg607.fun
kathinationindia.com
chonggonzalez.com
civitai.zone
unlimitednews.online
originswinery.com
byspektra.com
holisticstar.net
5vwl4z8.xyz
mx004.com
annuaire-brocante.com
getmangarock.com
my-chemicals.online
httpsaquexis.com
mavisnakliye.xyz
hemayah.live
lajtuf.com
soulguardgaming.com
hateyaocoeur.com
zloomux.com
haglove.stream
buybom.store
freeamateurzone.com
extremetechnology.shop
rabbitmobiles.com
myfertilitycoachuk.com
ledbrightled.com
blurwing.com
iptv-store.store
creditevangelists.com
zuwiz.com
gcgds.com
jumperspoods.com
lovletterstolife.store
socialpraises.net
bronessbros.com
souqshopper.com
kilid102.cloud
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3064-19-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/3064-22-0x0000000001170000-0x0000000001220000-memory.dmp formbook -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exedescription pid process target process PID 1688 set thread context of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exepowershell.exepid process 3064 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 2632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2632 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exedescription pid process target process PID 1688 wrote to memory of 2632 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe powershell.exe PID 1688 wrote to memory of 2632 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe powershell.exe PID 1688 wrote to memory of 2632 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe powershell.exe PID 1688 wrote to memory of 2632 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe powershell.exe PID 1688 wrote to memory of 2728 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe schtasks.exe PID 1688 wrote to memory of 2728 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe schtasks.exe PID 1688 wrote to memory of 2728 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe schtasks.exe PID 1688 wrote to memory of 2728 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe schtasks.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe PID 1688 wrote to memory of 3064 1688 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe 19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CBdqwn.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CBdqwn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7484.tmp"2⤵
- Creates scheduled task(s)
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19df4a6e35fc54bd0afb078f875b9690_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7484.tmpFilesize
1KB
MD5257fd1db9558d454439bb9a1e4410ef1
SHA18b66db9957776c9fe4793df9969cd8b1723719be
SHA256ffe8d4a8845a6c6c0085877690a29aedabcf5e29be9382553940cba9083454ab
SHA51261c7db8d40a2c85558985d2caf9aeada3ca904c730519319dd6123b5bb5b884db8721758d99963beba8bd2df0c320996896ce249481b7729197c0b93d8f6d7d1
-
memory/1688-3-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/1688-2-0x0000000000310000-0x0000000000326000-memory.dmpFilesize
88KB
-
memory/1688-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmpFilesize
4KB
-
memory/1688-5-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/1688-6-0x0000000000E50000-0x0000000000EBE000-memory.dmpFilesize
440KB
-
memory/1688-1-0x0000000001170000-0x0000000001220000-memory.dmpFilesize
704KB
-
memory/1688-21-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/3064-19-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3064-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3064-16-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3064-14-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3064-22-0x0000000001170000-0x0000000001220000-memory.dmpFilesize
704KB