Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
29/05/2024, 11:02
General
- Target 525bfc76b236fa42b9374eafd97cc750_NeikiAnalytics.exe
- Size 212KB
- Sample240529-m45phada84
- SHA256 849a5e7eff6eef790e95051dec8396cdf0ff2c1286ba304e0e3e09a1135bf811
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\525bfc76b236fa42b9374eafd97cc750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\525bfc76b236fa42b9374eafd97cc750_NeikiAnalytics.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
login[3].htm
A1C.tmp
A1C.tmp
CCB.tmp
CCB.tmp
E7A4.tmp
svchost.exe
memory/1456-0-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1456-12-0x0000000002210000-0x0000000002261000-memory.dmp
memory/1456-14-0x0000000000400000-0x000000000045F000-memory.dmp
memory/1456-11-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1456-2-0x0000000000400000-0x000000000045F000-memory.dmp
memory/1456-1-0x0000000002210000-0x0000000002261000-memory.dmp
memory/4936-61-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-52-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-22-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-21-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/4936-26-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-27-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-63-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-78-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-77-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-76-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-75-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-74-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-73-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-72-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-71-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-70-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-69-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-68-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-67-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-66-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-65-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-64-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-62-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-19-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-60-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-59-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-57-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-56-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-55-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-54-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-53-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-24-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-51-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-50-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-49-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-48-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-47-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-46-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-45-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-44-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-43-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-42-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-41-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-40-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-39-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-38-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-58-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-36-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-35-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-34-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-32-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-31-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-30-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-29-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-28-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-25-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-37-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/4936-18-0x0000000003140000-0x00000000031E8000-memory.dmp
memory/4936-17-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/4936-16-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/4936-15-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/4936-33-0x00000000032F0000-0x00000000033A6000-memory.dmp