Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe
-
Size
72KB
-
MD5
f46b3f82f7f53aac1897937ebcf4d080
-
SHA1
a91e214afddfde35d4e21b73cd52aea331c8233c
-
SHA256
36cc44eab4396339b792dd03143ddbe9ce95e6f9ad632c33c87a341fb7555599
-
SHA512
01efcf836ff7a5c82287942e244fa484ce3c1ed395f66575f12768cd6c052aff39746665041befd80b3cc76202540b02635e022d2e9d933485345ee6852b288f
-
SSDEEP
768:x/nLsOotoORa9BtsKq59qixs6LD908odASouD/7Vs6U2Y6AdYLSQhOUul8AeiRpr:xTxd9IKubv9svDzhkiLSQoUulHei26xP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ebgoodid-isom.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\ufrooboon.exe" ebgoodid-isom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" ebgoodid-isom.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eapcutuh-acex.exe" ebgoodid-isom.exe -
Executes dropped EXE 2 IoCs
pid Process 2504 ebgoodid-isom.exe 756 ebgoodid-isom.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ebgoodid-isom.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ebgoodid-isom.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ebgoodid-isom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\adxamit.dll" ebgoodid-isom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ebgoodid-isom.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ebgoodid-isom.exe f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ebgoodid-isom.exe f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ufrooboon.exe ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\adxamit.dll ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\ebgoodid-isom.exe ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\eapcutuh-acex.exe ebgoodid-isom.exe File created C:\Windows\SysWOW64\eapcutuh-acex.exe ebgoodid-isom.exe File opened for modification C:\Windows\SysWOW64\ufrooboon.exe ebgoodid-isom.exe File created C:\Windows\SysWOW64\adxamit.dll ebgoodid-isom.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 756 ebgoodid-isom.exe 756 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe 2504 ebgoodid-isom.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2504 ebgoodid-isom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2504 1640 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 83 PID 1640 wrote to memory of 2504 1640 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 83 PID 1640 wrote to memory of 2504 1640 f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe 83 PID 2504 wrote to memory of 756 2504 ebgoodid-isom.exe 84 PID 2504 wrote to memory of 756 2504 ebgoodid-isom.exe 84 PID 2504 wrote to memory of 756 2504 ebgoodid-isom.exe 84 PID 2504 wrote to memory of 612 2504 ebgoodid-isom.exe 5 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56 PID 2504 wrote to memory of 3432 2504 ebgoodid-isom.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f46b3f82f7f53aac1897937ebcf4d080_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\ebgoodid-isom.exe"C:\Windows\SysWOW64\ebgoodid-isom.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\ebgoodid-isom.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:756
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD53134c13dee949e007b7f55e04c58690c
SHA1a7f966eda611698145ed42c8a5a756561460384b
SHA2563cc871fbc3a7e6d7702c9051e8150661655275e5c5961e12dbd8975aff4694d9
SHA512f951f6cc95001d924b6de2d55b67efd1aab4cd0c0419ab96a63f98fc547fa8a4db42b9fcfafd33e4a0dcbb3943f7b50e852c4f689dbfc58ae8d6fb8fca590827
-
Filesize
70KB
MD528676f88063eac301d53b321f191dcea
SHA102d6269e6d1047629981dd26ea5960b0a2829467
SHA2563d1287f86ec5079ef21b71d45f716f9c8a422eafb61e1b66cc841c734ffd77c2
SHA512efc8af71861d50361000175f27f857e8c5b0bff380f2da72da4f4a65566ab433ad132e5c3c0be136b2bdae440f1d4df15116e6dd382bf9f9f7ef5a591e8f432a
-
Filesize
72KB
MD51130052079859e0a1f7b29a1e8343238
SHA12a2898ce735b7a88be3ca2a092d8a11b6abd8c14
SHA256cec6861b66d141543d8a979d716614bece0726ef41021b7d9a38ba5e41cd01bf
SHA512f7de2eeb4c614d4d57aa535debe75a73763fda12a448f0d4ccb86347878fc2eac33c209be40b14fd397416b6892ee8786a533c8ae704045cce8b39fc67958252