Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe
-
Size
72KB
-
MD5
61de036bf4ee6266864e8f4d872f4590
-
SHA1
c4f5c976b761ea8bdc4c7631d08f2666103de389
-
SHA256
4524b9efba95b60bb75596bd85653e54ae94132d386190ff86a28b53cfaa1b28
-
SHA512
69127883257164473a56278ad6b068210bf204f040f8a1dbb1e355fccb9bab9d3758d6d25efc255ec4ba86481e2844079d1094dd4751e570632bea2916c1aafd
-
SSDEEP
1536:xFA56h4XCr4FQ1qOFufvaxsYK281DHK2Fs6UDhDZFSLHXVGIynej:Di6aQR0XLF1Dqb6UDhDZFSLHXVEej
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" utteasut-ageab.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\ondohoam.exe" utteasut-ageab.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ebmatob.exe" utteasut-ageab.exe -
Executes dropped EXE 2 IoCs
pid Process 4592 utteasut-ageab.exe 2404 utteasut-ageab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" utteasut-ageab.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\aggodoov-cooc.dll" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" utteasut-ageab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} utteasut-ageab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" utteasut-ageab.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\utteasut-ageab.exe 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ondohoam.exe utteasut-ageab.exe File created C:\Windows\SysWOW64\aggodoov-cooc.dll utteasut-ageab.exe File opened for modification C:\Windows\SysWOW64\aggodoov-cooc.dll utteasut-ageab.exe File opened for modification C:\Windows\SysWOW64\utteasut-ageab.exe utteasut-ageab.exe File opened for modification C:\Windows\SysWOW64\utteasut-ageab.exe 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ebmatob.exe utteasut-ageab.exe File created C:\Windows\SysWOW64\ebmatob.exe utteasut-ageab.exe File created C:\Windows\SysWOW64\ondohoam.exe utteasut-ageab.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 2404 utteasut-ageab.exe 2404 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe 4592 utteasut-ageab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4592 utteasut-ageab.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 848 wrote to memory of 4592 848 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 84 PID 848 wrote to memory of 4592 848 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 84 PID 848 wrote to memory of 4592 848 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 84 PID 4592 wrote to memory of 2404 4592 utteasut-ageab.exe 85 PID 4592 wrote to memory of 2404 4592 utteasut-ageab.exe 85 PID 4592 wrote to memory of 2404 4592 utteasut-ageab.exe 85 PID 4592 wrote to memory of 592 4592 utteasut-ageab.exe 5 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56 PID 4592 wrote to memory of 3528 4592 utteasut-ageab.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:592
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\utteasut-ageab.exe"C:\Windows\SysWOW64\utteasut-ageab.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\utteasut-ageab.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2404
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD5ab029028e8a92905fac725d4b5b5450d
SHA1f3518b0d880ba720eb5964c2d3227fbca61c03f2
SHA25617a7ce8ecb875d26eaaced39e273233b3358c114f65732895abb0061bb1a334e
SHA512d14f907296039eb3a245934b8ac5aeb08f0cb052a91c0ad17b2cf2ee7bf0144f9a4922dca0b57575198273f41222ee31d865f71d6f5a9d13ebf3d401e59fe9ac
-
Filesize
72KB
MD5d08b2f13a792fbe8f2f0f3bf2185c65b
SHA1d145a8932804555590e3848f4ccb7b4d7751f366
SHA25645fd0ca9c0b9b9e1f33f83740c66b63d8874f6ec8d50c08070d819ed41ad5caa
SHA5121102f8294a78ffd6b9e8c949e835ea61cb43fb20f22657fe31d7ee133967e5a3fe475efa02a0af9f9b4b8afd0c81f1b8479d606508e960950f85738c9dbe75c9
-
Filesize
70KB
MD52b9bbbbef8f8c16abe4559de79a0ebf1
SHA1c92497507fde5caf15130bf1cf88d5017e3cfbff
SHA256fd6fe433a41b194720d083015dca28bddc9e48a141a47f4a70f39ccb70ff39fe
SHA51237a3075d7606f64bc14de82044d46899c3989fc1038e812c31448b2fa7e84058c7799023d684d9da0ede3dcfb236f359fafe0e1f9d71a8ea90eafaa1459ccc28