Analysis
- max time kernel
149s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
27/05/2024, 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe
- Size 71KB
- Sample240527-g9atesba7x
- SHA256 f26c2e901fd1ff3fc512d6a0e06b08dda67d3f3ee55fa2cfa1a4d81e1c4c2595
- MD5 22c056b74ec4e9badbf600f27ea1c350
- SHA1 3cb59f8f0daa69ab39163f58dd9345a860277371
- SHA512 a89463e02e3b25113c48df4a885afa07e22042b39a25c12c66e502d51b57f4fad75d27f279646ee66b2d2f2b2c0f095b125e44fe8b67566359dbefc5dcf1438f
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl1LK4X:Olg35GTslA5t3/w8T4X
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oukfufos.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\emfoaguh-cix.exe" oukfufos.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouvbeager.exe" oukfufos.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" oukfufos.exe - Executes dropped EXE 2 IoCs
pid Process 3024 oukfufos.exe 2788 oukfufos.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oukfufos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oukfufos.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\hrapar.dll" oukfufos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" oukfufos.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} oukfufos.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\hrapar.dll oukfufos.exe File created C:\Windows\SysWOW64\hrapar.dll oukfufos.exe File opened for modification C:\Windows\SysWOW64\oukfufos.exe oukfufos.exe File opened for modification C:\Windows\SysWOW64\oukfufos.exe 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ouvbeager.exe oukfufos.exe File created C:\Windows\SysWOW64\emfoaguh-cix.exe oukfufos.exe File created C:\Windows\SysWOW64\oukfufos.exe 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ouvbeager.exe oukfufos.exe File opened for modification C:\Windows\SysWOW64\emfoaguh-cix.exe oukfufos.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 2788 oukfufos.exe 2788 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe 3024 oukfufos.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3356 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe Token: SeDebugPrivilege 3024 oukfufos.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3356 wrote to memory of 3024 3356 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 83 PID 3356 wrote to memory of 3024 3356 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 83 PID 3356 wrote to memory of 3024 3356 22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe 83 PID 3024 wrote to memory of 2788 3024 oukfufos.exe 84 PID 3024 wrote to memory of 2788 3024 oukfufos.exe 84 PID 3024 wrote to memory of 2788 3024 oukfufos.exe 84 PID 3024 wrote to memory of 620 3024 oukfufos.exe 5 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55 PID 3024 wrote to memory of 3476 3024 oukfufos.exe 55
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22c056b74ec4e9badbf600f27ea1c350_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\oukfufos.exe"C:\Windows\system32\oukfufos.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\oukfufos.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\emfoaguh-cix.exe
- Size 73KB
- SHA256 8bc2c79e2df4623a3e84de6a8e32ce2f3694ebacc3cb7201f5afa8e6b1727ea9
- MD5 16f9cf20a108ea48f996354417e6da82
- SHA1 d95bd566979f146c92025a098470c27cd4c684a6
- SHA512 7627b6d6849740c5f440047dbf24f12123295a96ef93f652e5b145c8e812509ff45bfbcc326d315865e79c1fd38d4629a1d47476339d0984f74811334719cfce
- SSDEEP 1536:x2zDjFBlS8G13YgsQSGE4zCvrbiCFkaG8pyb2y+/ki6z7:QPBBFGtzcJkaxpFAi6z7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hrapar.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\oukfufos.exe
- Size 71KB
- SHA256 f26c2e901fd1ff3fc512d6a0e06b08dda67d3f3ee55fa2cfa1a4d81e1c4c2595
- MD5 22c056b74ec4e9badbf600f27ea1c350
- SHA1 3cb59f8f0daa69ab39163f58dd9345a860277371
- SHA512 a89463e02e3b25113c48df4a885afa07e22042b39a25c12c66e502d51b57f4fad75d27f279646ee66b2d2f2b2c0f095b125e44fe8b67566359dbefc5dcf1438f
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl1LK4X:Olg35GTslA5t3/w8T4X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ouvbeager.exe
- Size 74KB
- SHA256 a48f18c8dcca82d76a877294b761a22642f2728cac6fcfd343fb58526c0dcce6
- MD5 45d8c050cf215b7d55ee2e65eec1c43c
- SHA1 ad2909390b7f0e9075e1a11e69730a229131c9cb
- SHA512 520eec4422cb5ffab46a6059c22dc543dad67fa9298daa61d8cbd5896c7bd639d9d82ba225847442aaf1ab89a86bdc170fab259c9c82fc40a2fab85be7a4fdfc
- SSDEEP 1536:1P2Yxh0OLiB61sKlFUq9Jy3h97q0wRpQwwMafbq:V2+iA+K9cx97q0wzQVMWq
- MD5 SHA1 SHA512 SSDEEP