42c8b2151b33b840b18d06e6f27bb3974974aa32df108571bbcd2832cb836022

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54699a1e2a908bce86e1ac1044d59d60_NeikiAnalytics.dll
Size

3.7MB
MD5

54699a1e2a908bce86e1ac1044d59d60
SHA1

b02b05e0b9fd676369cc46f52d2021e60c67cd98
SHA256

42c8b2151b33b840b18d06e6f27bb3974974aa32df108571bbcd2832cb836022
SHA512

98c01673ef3ca5f3565591799d9a56609af0f5912f686cdbee0b02e63671f03b5c00bc52cd8fcb7fc2ac49a3640d75d7975baae54a0f7b04734964127c83ab2d
SSDEEP

98304:YMKKBXt4hlRGIpfi9NnTscJkNP5AMHsgn:YMKKBXklwIoTzeNP5AMH

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B5-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08BC-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08BD-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{373984C8-B845-449B-91E7-45AC83036ADE}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B6-DD1B-4664-9A50-C2F40F4BD79A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B3-DD1B-4664-9A50-C2F40F4BD79A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XMLParser.2.6\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF88-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF8D-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B7-DD1B-4664-9A50-C2F40F4BD79A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5078F20-C551-11D3-89B9-0000F81FE221}\Version\ = "2.6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E9196BF-13BA-4DD4-91CA-6C571F281495}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1299EB1B-5B88-433E-82DE-82CA75AD4E04}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF86-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF93-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5078F20-C551-11D3-89B9-0000F81FE221}\ProgId\ = "Msxml2.XMLParser.2.6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF83-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF87-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F10D27CC-3EC0-415C-8ED8-77AB1C5E7262}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF89-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08BE-DD1B-4664-9A50-C2F40F4BD79A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF85-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{796E7AC5-5AA2-4EFF-ACAD-3FAAF01A3288}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4D7FF4BA-1565-4EA8-94E1-6E724A46F98D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF82-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF8A-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA4BB38C-FAF9-4CCA-9302-D1DD0FE520DB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C90352F5-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C90352F7-643C-4FBC-BB23-E996EB2D51FD}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B4-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{65725580-9B5D-11D0-9BFE-00C04FC99C8E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EFAA426-272F-11D2-836F-0000F87A7782}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EFAA429-272F-11D2-836F-0000F87A7782}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{032AAC35-8C0E-4D9D-979F-E3B702935576}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XMLParser.2.6\ = "XML Parser 2.6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF96-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED8C108D-4349-11D2-91A4-00C04F7969E8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E01311B-C322-4B0A-BD77-B90CFDC8DCE7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EFAA428-272F-11D2-836F-0000F87A7782}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{808F4E35-8D5A-4FBE-8466-33A41279ED30}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50EA08B8-DD1B-4664-9A50-C2F40F4BD79A}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5078F20-C551-11D3-89B9-0000F81FE221}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF81-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF8E-7B36-11D2-B20E-00C04F983E60}\ProxyStubClsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10DC0586-132B-4CAC-8BB3-DB00AC8B7EE0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8917260-7579-4BE1-B5DD-7AFBFA6F077B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5078F20-C551-11D3-89B9-0000F81FE221}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA634FC7-5888-44A7-A257-3A47150D3A0E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2933BF84-7B36-11D2-B20E-00C04F983E60}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4608	1012	regsvr32.exe	83
PID 1012 wrote to memory of 4608	1012	regsvr32.exe	83
PID 1012 wrote to memory of 4608	1012	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\54699a1e2a908bce86e1ac1044d59d60_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\54699a1e2a908bce86e1ac1044d59d60_NeikiAnalytics.dll
  2⤵
  - Modifies registry class
  PID:4608

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads