Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
30/05/2024, 14:06
General
- Target d343682dfdd961ff1b929e42ddfa3810_NeikiAnalytics.exe
- Size 218KB
- Sample240530-redxpscc32
- SHA256 ac51ebf2d73f00e7f713dda5fa3093610b8bb19d5d972d5077cfd9d5db50430c
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d343682dfdd961ff1b929e42ddfa3810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d343682dfdd961ff1b929e42ddfa3810_NeikiAnalytics.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
login[1].htm
3A4B.tmp
40E8.tmp
8EF5.tmp
8EF5.tmp
A50A.tmp
A52C.tmp
A52C.tmp
svchost.exe
memory/2752-1-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2752-12-0x0000000002330000-0x0000000002381000-memory.dmp
memory/2752-13-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2752-10-0x0000000000400000-0x00000000005AE000-memory.dmp
memory/2752-0-0x0000000002330000-0x0000000002381000-memory.dmp
memory/3764-49-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-39-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-22-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-24-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-23-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-71-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-72-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-80-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-78-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-76-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-75-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-74-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-70-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-69-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-67-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-65-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-64-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-62-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-61-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-59-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-57-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-55-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-52-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-50-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-18-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-47-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-46-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-44-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-43-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-41-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-40-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-20-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-37-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-36-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-35-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-33-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-32-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-30-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-29-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-27-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-79-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-77-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-73-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-68-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-66-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-63-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-60-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-58-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-54-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-53-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-51-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-48-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-45-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-42-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-38-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-34-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-31-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-17-0x0000000000400000-0x00000000005AE000-memory.dmp
memory/3764-15-0x0000000000400000-0x00000000005AE000-memory.dmp
memory/3764-16-0x00000000028D0000-0x0000000002978000-memory.dmp
memory/3764-14-0x0000000000400000-0x00000000005AE000-memory.dmp
memory/3764-28-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-26-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3764-25-0x0000000002D00000-0x0000000002DB6000-memory.dmp