58997b5212ffdd669b6b4b6479a90055c6a590f39a520021c32bb60737b0db22

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe
Size 69KB
Sample240530-pha9wagg3v
SHA256 58997b5212ffdd669b6b4b6479a90055c6a590f39a520021c32bb60737b0db22
MD5 32f041fdf01d2dfea68dac0191c6d020
SHA1 a5634ab98a96da3d12349c9e1ac901d0b1655e6c
SHA512 49f388421edb19661520b3a076cc0a0674c6ced24e6e267651e07376a67f87a44eb1c02bd3aba5f43c584645fe98817ac24620f614798ab2556a6ca7f3e9c1e0
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8I:Olg35GTslA5t3/w8I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	dtooheag.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\IsInstalled = "1"	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47594C51-574a-434e-4759-4C51574A434e}\StubPath = "C:\\Windows\\system32\\ouxxaxoc-ougor.exe"	dtooheag.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ingocom.exe"	dtooheag.exe

Executes dropped EXE 2 IoCs

pid	Process
4392	dtooheag.exe
5044	dtooheag.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	dtooheag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	dtooheag.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ouxnoomev-eador.dll"	dtooheag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	dtooheag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	dtooheag.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dtooheag.exe	32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\ingocom.exe	dtooheag.exe
File opened for modification	C:\Windows\SysWOW64\ouxxaxoc-ougor.exe	dtooheag.exe
File created	C:\Windows\SysWOW64\ouxxaxoc-ougor.exe	dtooheag.exe
File created	C:\Windows\SysWOW64\ouxnoomev-eador.dll	dtooheag.exe
File opened for modification	C:\Windows\SysWOW64\dtooheag.exe	32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ingocom.exe	dtooheag.exe
File opened for modification	C:\Windows\SysWOW64\ouxnoomev-eador.dll	dtooheag.exe
File opened for modification	C:\Windows\SysWOW64\dtooheag.exe	dtooheag.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
5044	dtooheag.exe
5044	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe
4392	dtooheag.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe
Token: SeDebugPrivilege	4392	dtooheag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4392	4084	32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe	90
PID 4084 wrote to memory of 4392	4084	32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe	90
PID 4084 wrote to memory of 4392	4084	32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe	90
PID 4392 wrote to memory of 5044	4392	dtooheag.exe	91
PID 4392 wrote to memory of 5044	4392	dtooheag.exe	91
PID 4392 wrote to memory of 5044	4392	dtooheag.exe	91
PID 4392 wrote to memory of 620	4392	dtooheag.exe	5
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56
PID 4392 wrote to memory of 3476	4392	dtooheag.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3476
- C:\Users\Admin\AppData\Local\Temp\32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\32f041fdf01d2dfea68dac0191c6d020_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\dtooheag.exe
    "C:\Windows\system32\dtooheag.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\SysWOW64\dtooheag.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2648,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dtooheag.exe

Path C:\Windows\SysWOW64\dtooheag.exe
Size 69KB
SHA256 58997b5212ffdd669b6b4b6479a90055c6a590f39a520021c32bb60737b0db22
MD5 32f041fdf01d2dfea68dac0191c6d020
SHA1 a5634ab98a96da3d12349c9e1ac901d0b1655e6c
SHA512 49f388421edb19661520b3a076cc0a0674c6ced24e6e267651e07376a67f87a44eb1c02bd3aba5f43c584645fe98817ac24620f614798ab2556a6ca7f3e9c1e0
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8I:Olg35GTslA5t3/w8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ingocom.exe

Path C:\Windows\SysWOW64\ingocom.exe
Size 73KB
SHA256 2646d5684e867c395e9f72eaa816959f3866cdb7c81ab9b7fd5b4bfdd1173629
MD5 1e17627f37475c52cba79849a1331d0e
SHA1 2d2902514f38205321b0fd2b6334d8d367af2c95
SHA512 76a7c004ce4082d6615f216ef308deaa40c0151abdfc31d600ecb71bcd91217eb9bce48c46a3c43d785538e0e39e94ca99942f9f15c4fd7aea58ed3670795ddd
SSDEEP 1536:12l0TX0IW6EYEDpMA9YnjFUP9WVD7U4v2ybGvsxbxMGW/:c/IWlDWU+7U5ybAGMV/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ouxnoomev-eador.dll

Path C:\Windows\SysWOW64\ouxnoomev-eador.dll
Size 5KB
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ouxxaxoc-ougor.exe

Path C:\Windows\SysWOW64\ouxxaxoc-ougor.exe
Size 72KB
SHA256 a3a0de150a992f8961a779bfeac2396b11b95d3fb5e3049f362c76ff5432a06e
MD5 e21ec68c08b7f41dc7f1cd3291b9e467
SHA1 56756355a72e5c8aeb2a13706dbbe0e31ecc2055
SHA512 9c4d1d7934794cb20d2033dc27d96b6fafaebc13d7bbbd45f84727d2e0e1553d468052d03b7fd9c36269d5d171501de9c9a7fe9666625ed3f7299ac2c8a9caaf
SSDEEP 1536:xBbNMI05ZPS2u30T8m99zfC5dhPIBUCwJLN9SZui1ZOmM:5MIqu30T8mf+P+UCwJB9Sh1ZOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4084-6-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4392-49-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5044-50-0x0000000000400000-0x0000000000414000-memory.dmp

Download