Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
6c05153b50a7cbfbb1a35bad0aa61aa0
-
SHA1
6b31787382a160d4e65824755723f88c6d3a212e
-
SHA256
63f5a6adc5b84d2542fb1c41a95d33fc3577c4ec63c0e557f6be127c6f92b5f8
-
SHA512
f70cd4934c6b849787c2effa93ef98c4db8574c15c6305d8a0b6349454bbed0ed2ad604e9dfc9ed168534b6624201d7f9c246c5866282beb04ea1abca0279918
-
SSDEEP
768:U4DwsQb6K4Fd6eUCRGIIPP1y7oLacaIBLP3ner42Q:UgtBTFTUCxQ1aZr42Q
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wdloum.exe -
Executes dropped EXE 1 IoCs
pid Process 1612 wdloum.exe -
Loads dropped DLL 2 IoCs
pid Process 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /d" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /f" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /n" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /p" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /e" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /z" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /o" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /k" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /i" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /s" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /u" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /v" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /q" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /y" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /w" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /b" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /c" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /a" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /j" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /m" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /t" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /x" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /g" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /l" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /h" wdloum.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /m" 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\wdloum = "C:\\Users\\Admin\\wdloum.exe /r" wdloum.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe 1612 wdloum.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 1612 wdloum.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1612 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 28 PID 2176 wrote to memory of 1612 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 28 PID 2176 wrote to memory of 1612 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 28 PID 2176 wrote to memory of 1612 2176 6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c05153b50a7cbfbb1a35bad0aa61aa0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\wdloum.exe"C:\Users\Admin\wdloum.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD519e30cab8a16ee0ac42792eaaaee64c7
SHA13db61176fd607a84c4002192711ba54388ab8822
SHA256b277f087cae238efd5b7fd459a45011e8fa773d17b36b7369773c52458129dff
SHA512f333a9491a6e0abdfd73b1f1a75c9486109b8eb6708f7542444cb43f7690ecd327d23f29861a30adf6ce8c859878212842ae402c27a636f1da104d7c4c509790