Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
260ab996b2fdbd6b2d66e8cb1ba2a570_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
260ab996b2fdbd6b2d66e8cb1ba2a570_NeikiAnalytics.dll
-
Size
120KB
-
MD5
260ab996b2fdbd6b2d66e8cb1ba2a570
-
SHA1
313d989bd154963fa6160e56c3449d92aae5c182
-
SHA256
37fa656e253f8b09326525d3df9c198b36184dab9310d23a13b8cdf0dc4222a3
-
SHA512
69bb877366cc97e68f32332674af46b1ccb3f35aacc3806dac6071c5a037d34242b830eee6aa442456cd1617ea1cb9eed010955cbfb45f3257e96a75707ec178
-
SSDEEP
1536:68xs7FcFqqV05nbn4RGymMU7yAyIhDUEsmdXDAvLZ6f5T8A+oKxue0kMDLPLjLI+:rD+4DgyAZDR2Z6fp8A5DL7s1b
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f762952.exef7644ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762952.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762952.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7644ec.exe -
Processes:
f762952.exef7644ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7644ec.exe -
Processes:
f762952.exef7644ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7644ec.exe -
Executes dropped EXE 3 IoCs
Processes:
f762952.exef762c6d.exef7644ec.exepid process 2932 f762952.exe 2672 f762c6d.exe 2596 f7644ec.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2932-13-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-15-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-17-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-19-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-21-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-22-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-20-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-18-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-16-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-23-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-63-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-64-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-65-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-66-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-67-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-69-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-70-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-84-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-86-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-88-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-126-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2932-154-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2596-171-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2596-208-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Processes:
f7644ec.exef762952.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7644ec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7644ec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762952.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7644ec.exe -
Processes:
f762952.exef7644ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7644ec.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f762952.exef7644ec.exedescription ioc process File opened (read-only) \??\N: f762952.exe File opened (read-only) \??\P: f762952.exe File opened (read-only) \??\H: f762952.exe File opened (read-only) \??\I: f762952.exe File opened (read-only) \??\K: f762952.exe File opened (read-only) \??\S: f762952.exe File opened (read-only) \??\E: f7644ec.exe File opened (read-only) \??\G: f762952.exe File opened (read-only) \??\L: f762952.exe File opened (read-only) \??\Q: f762952.exe File opened (read-only) \??\J: f762952.exe File opened (read-only) \??\O: f762952.exe File opened (read-only) \??\E: f762952.exe File opened (read-only) \??\M: f762952.exe File opened (read-only) \??\R: f762952.exe -
Drops file in Windows directory 3 IoCs
Processes:
f762952.exef7644ec.exedescription ioc process File created C:\Windows\f762a2c f762952.exe File opened for modification C:\Windows\SYSTEM.INI f762952.exe File created C:\Windows\f767b96 f7644ec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f762952.exef7644ec.exepid process 2932 f762952.exe 2932 f762952.exe 2596 f7644ec.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f762952.exef7644ec.exedescription pid process Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2932 f762952.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe Token: SeDebugPrivilege 2596 f7644ec.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef762952.exef7644ec.exedescription pid process target process PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 1460 wrote to memory of 2816 1460 rundll32.exe rundll32.exe PID 2816 wrote to memory of 2932 2816 rundll32.exe f762952.exe PID 2816 wrote to memory of 2932 2816 rundll32.exe f762952.exe PID 2816 wrote to memory of 2932 2816 rundll32.exe f762952.exe PID 2816 wrote to memory of 2932 2816 rundll32.exe f762952.exe PID 2932 wrote to memory of 1112 2932 f762952.exe taskhost.exe PID 2932 wrote to memory of 1160 2932 f762952.exe Dwm.exe PID 2932 wrote to memory of 1224 2932 f762952.exe Explorer.EXE PID 2932 wrote to memory of 1580 2932 f762952.exe DllHost.exe PID 2932 wrote to memory of 1460 2932 f762952.exe rundll32.exe PID 2932 wrote to memory of 2816 2932 f762952.exe rundll32.exe PID 2932 wrote to memory of 2816 2932 f762952.exe rundll32.exe PID 2816 wrote to memory of 2672 2816 rundll32.exe f762c6d.exe PID 2816 wrote to memory of 2672 2816 rundll32.exe f762c6d.exe PID 2816 wrote to memory of 2672 2816 rundll32.exe f762c6d.exe PID 2816 wrote to memory of 2672 2816 rundll32.exe f762c6d.exe PID 2816 wrote to memory of 2596 2816 rundll32.exe f7644ec.exe PID 2816 wrote to memory of 2596 2816 rundll32.exe f7644ec.exe PID 2816 wrote to memory of 2596 2816 rundll32.exe f7644ec.exe PID 2816 wrote to memory of 2596 2816 rundll32.exe f7644ec.exe PID 2932 wrote to memory of 1112 2932 f762952.exe taskhost.exe PID 2932 wrote to memory of 1160 2932 f762952.exe Dwm.exe PID 2932 wrote to memory of 1224 2932 f762952.exe Explorer.EXE PID 2932 wrote to memory of 2672 2932 f762952.exe f762c6d.exe PID 2932 wrote to memory of 2672 2932 f762952.exe f762c6d.exe PID 2932 wrote to memory of 2596 2932 f762952.exe f7644ec.exe PID 2932 wrote to memory of 2596 2932 f762952.exe f7644ec.exe PID 2596 wrote to memory of 1112 2596 f7644ec.exe taskhost.exe PID 2596 wrote to memory of 1160 2596 f7644ec.exe Dwm.exe PID 2596 wrote to memory of 1224 2596 f7644ec.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f762952.exef7644ec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7644ec.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\260ab996b2fdbd6b2d66e8cb1ba2a570_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\260ab996b2fdbd6b2d66e8cb1ba2a570_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\f762952.exeC:\Users\Admin\AppData\Local\Temp\f762952.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2932
-
-
C:\Users\Admin\AppData\Local\Temp\f762c6d.exeC:\Users\Admin\AppData\Local\Temp\f762c6d.exe4⤵
- Executes dropped EXE
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\f7644ec.exeC:\Users\Admin\AppData\Local\Temp\f7644ec.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2596
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5528cf456e7b9d6b80485f51a2bb1e707
SHA1ced162d61d17ad41f4a4faed8b87c953653cd1db
SHA256944f6c6d0e363491514117a3ec61de6705693bf345bef67844cff72322027fdd
SHA51291a918dc115bb6d32bffe3615e7ad94826e30b9ba7eeefb621fcbad6faad67b1ea8f5850dc75adc90b8f70e50f0608c25e5de1a44471b4abf017eed1e3f39b1b
-
Filesize
97KB
MD5ae276d980538e9af72bac3bc0bef31b8
SHA133d479e13f9d29fc6236cb579b0848c30ee41895
SHA2561b023f85b2bdb77faa5cd5c21fae0763ddf5f29adde51fc5ef30390f7c20a8e4
SHA512fbd98968933c308d3702e3d30b435e01d71ef1955a6531be6f665760e8baf7b839e43bbbb6ea4f1ea218a2d391812881b4552f384162a44dc4205b1b186e03e8