Analysis
- max time kernel
149s - max time network
120s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
27/05/2024, 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe
- Size 71KB
- Sample240527-g9atesba7x
- SHA256 f26c2e901fd1ff3fc512d6a0e06b08dda67d3f3ee55fa2cfa1a4d81e1c4c2595
- MD5 22c056b74ec4e9badbf600f27ea1c350
- SHA1 3cb59f8f0daa69ab39163f58dd9345a860277371
- SHA512 a89463e02e3b25113c48df4a885afa07e22042b39a25c12c66e502d51b57f4fad75d27f279646ee66b2d2f2b2c0f095b125e44fe8b67566359dbefc5dcf1438f
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl1LK4X:Olg35GTslA5t3/w8T4X
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oukfufos.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245} oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\IsInstalled = "1" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\StubPath = "C:\\Windows\\system32\\emfoaguh-cix.exe" oukfufos.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouvbeager.exe" oukfufos.exe - Executes dropped EXE 2 IoCs
pid Process 2884 oukfufos.exe 2532 oukfufos.exe - Loads dropped DLL 3 IoCs
pid Process 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 2884 oukfufos.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oukfufos.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} oukfufos.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\hrapar.dll" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" oukfufos.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ouvbeager.exe oukfufos.exe File opened for modification C:\Windows\SysWOW64\hrapar.dll oukfufos.exe File opened for modification C:\Windows\SysWOW64\oukfufos.exe oukfufos.exe File opened for modification C:\Windows\SysWOW64\ouvbeager.exe oukfufos.exe File created C:\Windows\SysWOW64\oukfufos.exe 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\emfoaguh-cix.exe oukfufos.exe File created C:\Windows\SysWOW64\emfoaguh-cix.exe oukfufos.exe File created C:\Windows\SysWOW64\hrapar.dll oukfufos.exe File opened for modification C:\Windows\SysWOW64\oukfufos.exe 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2532 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe 2884 oukfufos.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe Token: SeDebugPrivilege 2884 oukfufos.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2884 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 28 PID 2324 wrote to memory of 2884 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 28 PID 2324 wrote to memory of 2884 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 28 PID 2324 wrote to memory of 2884 2324 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 28 PID 2884 wrote to memory of 436 2884 oukfufos.exe 5 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 2532 2884 oukfufos.exe 29 PID 2884 wrote to memory of 2532 2884 oukfufos.exe 29 PID 2884 wrote to memory of 2532 2884 oukfufos.exe 29 PID 2884 wrote to memory of 2532 2884 oukfufos.exe 29 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20 PID 2884 wrote to memory of 1152 2884 oukfufos.exe 20
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\oukfufos.exe"C:\Windows\system32\oukfufos.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\oukfufos.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\emfoaguh-cix.exe
- Size 73KB
- SHA256 d26edfde9edb5e04ffb6613b5e0961d53bae533b2564565ff99f2ffe2514443f
- MD5 6d62e2de5a05a673479ffaa28c2391bd
- SHA1 0720e7011fcaf905777e69d736526fbfedd33adb
- SHA512 f3ce0c93d6cfa89948e85c2ab1d81884c17b4c9018c7059f3be390848e444b23bb1470c82aedf96fb0b14dbde7fc7d85937800211bad93e8c38517007de450de
- SSDEEP 1536:x05eSd2CGilFul/vKVjb/uNf5Nf8kuHPvIRgHqgo:cDavcbUZ8tr4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hrapar.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ouvbeager.exe
- Size 74KB
- SHA256 0549883f838d1ef0ecffdc6f36efd2c0cb15c94ad00fbe39343952a61ff7c40f
- MD5 78454d47158a599d2aad3d5f8ac1727f
- SHA1 abfdd3f02194b6f5b45f750efde87a3cb0864e25
- SHA512 63a6e6fc60aac722e6064a44dea1329433b41aedb4a75b24120b1be81b2ce458f263fa403ac831c8877de11bc5619bdef8fae96ac0f863ccb35909da51e27912
- SSDEEP 1536:13zOORyuTKxBpkcoIOgm5qyrY4xhzO2dsx:9/Kx8DIOvqeY4PzOXx
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\oukfufos.exe
- Size 71KB
- SHA256 f26c2e901fd1ff3fc512d6a0e06b08dda67d3f3ee55fa2cfa1a4d81e1c4c2595
- MD5 22c056b74ec4e9badbf600f27ea1c350
- SHA1 3cb59f8f0daa69ab39163f58dd9345a860277371
- SHA512 a89463e02e3b25113c48df4a885afa07e22042b39a25c12c66e502d51b57f4fad75d27f279646ee66b2d2f2b2c0f095b125e44fe8b67566359dbefc5dcf1438f
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl1LK4X:Olg35GTslA5t3/w8T4X
- MD5 SHA1 SHA512 SSDEEP