Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe
-
Size
72KB
-
MD5
f46b3f82f7f53aac1897937ebcf4d080
-
SHA1
a91e214afddfde35d4e21b73cd52aea331c8233c
-
SHA256
36cc44eab4396339b792dd03143ddbe9ce95e6f9ad632c33c87a341fb7555599
-
SHA512
01efcf836ff7a5c82287942e244fa484ce3c1ed395f66575f12768cd6c052aff39746665041befd80b3cc76202540b02635e022d2e9d933485345ee6852b288f
-
SSDEEP
768:x/nLsOotoORa9BtsKq59qixs6LD908odASouD/7Vs6U2Y6AdYLSQhOUul8AeiRpr:xTxd9IKubv9svDzhkiLSQoUulHei26xP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ebgoodid-isom.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\IsInstalled = "1" ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\StubPath = "C:\\Windows\\system32\\ufrooboon.exe" ebgoodid-isom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350} ebgoodid-isom.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eapcutuh-acex.exe" ebgoodid-isom.exe -
Executes dropped EXE 2 IoCs
pid Process 2180 ebgoodid-isom.exe 2556 ebgoodid-isom.exe -
Loads dropped DLL 3 IoCs
pid Process 1900 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 1900 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 2180 ebgoodid-isom.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ebgoodid-isom.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\adxamit.dll" ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ebgoodid-isom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ebgoodid-isom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ebgoodid-isom.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ebgoodid-isom.exe f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe File created C:\Windows\SysWOW64\eapcutuh-acex.exe ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\ufrooboon.exe ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\adxamit.dll ebgoodid-isom.exe File created C:\Windows\SysWOW64\adxamit.dll ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\ebgoodid-isom.exe ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\ebgoodid-isom.exe f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\eapcutuh-acex.exe ebgoodid-isom.exe File created C:\Windows\SysWOW64\ufrooboon.exe ebgoodid-isom.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2556 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe 2180 ebgoodid-isom.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2180 ebgoodid-isom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2180 1900 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 28 PID 1900 wrote to memory of 2180 1900 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 28 PID 1900 wrote to memory of 2180 1900 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 28 PID 1900 wrote to memory of 2180 1900 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 28 PID 2180 wrote to memory of 432 2180 ebgoodid-isom.exe 5 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 2556 2180 ebgoodid-isom.exe 29 PID 2180 wrote to memory of 2556 2180 ebgoodid-isom.exe 29 PID 2180 wrote to memory of 2556 2180 ebgoodid-isom.exe 29 PID 2180 wrote to memory of 2556 2180 ebgoodid-isom.exe 29 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21 PID 2180 wrote to memory of 1180 2180 ebgoodid-isom.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\ebgoodid-isom.exe"C:\Windows\SysWOW64\ebgoodid-isom.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\ebgoodid-isom.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD507b64f6e657b4b36e609dd5a24b5d278
SHA18e3fd582732d758ed8f7e47bd8a5f2ad9c3f49c4
SHA256d827a2f73b91ac5d9c90562aa271e226800ab97a592719dfb2872c516142092a
SHA51295ce63f1f34eb43b55905c834bce304eb6d6188c42f6b1e7fb092f63e4b7af52ef1da675bafea6e772377fcb1dffef9dfbf776cf10ff182111d6272d71a64ed8
-
Filesize
72KB
MD560ac6931b3e8e282167e5e0220cf7a71
SHA15c51b1c05e42d290e1fb89828b33744b4e88b5e3
SHA25620bed9c09f733314727a12103dd85a324e1940f0070f51bc5d99e776da699350
SHA512a3c24058c47e07ecc5fd30a3a813193f91c08384caa5ee0cc3934992c50d0a3a08c6f727570234802395329374437c7441b64a20702646b8acca212a66c7fad2
-
Filesize
70KB
MD528676f88063eac301d53b321f191dcea
SHA102d6269e6d1047629981dd26ea5960b0a2829467
SHA2563d1287f86ec5079ef21b71d45f716f9c8a422eafb61e1b66cc841c734ffd77c2
SHA512efc8af71861d50361000175f27f857e8c5b0bff380f2da72da4f4a65566ab433ad132e5c3c0be136b2bdae440f1d4df15116e6dd382bf9f9f7ef5a591e8f432a