cee49b636b54fa9617e5fbfc5186ad41b9fd0292dd84f147062945a003975693

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe
Size

209KB
MD5

809b85e4861b490c94409b5bb47824f0
SHA1

f3fa90aafec3ee8bac167f437561153e8d623e8a
SHA256

cee49b636b54fa9617e5fbfc5186ad41b9fd0292dd84f147062945a003975693
SHA512

077c31ce27844c08eda19c16db0cde614cca5cdfa7614cfcb6d69c08ba66eafaf037b883211d7ed261724ea79ef587f0ff16cf62fbd828c16e209f3797f0ea66
SSDEEP

3072:kQcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:kQh9tVRm2kh34hdeCkcG7DEALLlnN

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1208	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe
1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1580-1-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1580-16-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1208-19-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral1/memory/1208-31-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\eb272e25 = "C:\\Windows\\apppatch\\svchost.exe"	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\eb272e25 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe
1208	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1208	1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe	28
PID 1580 wrote to memory of 1208	1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe	28
PID 1580 wrote to memory of 1208	1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe	28
PID 1580 wrote to memory of 1208	1580	809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\809b85e4861b490c94409b5bb47824f0NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\AppPatch\svchost.exe

Filesize
209KB

MD5
89fb52ec4743fa750ef9e98932244a34

SHA1
b315bbfb0a47407072d44b9b424dc1d74fde6506

SHA256
1200fb75ac62d28b7d29a5ecdd9f917b86936093c30b7218f5181dd509dd790c

SHA512
5f80a7967180c06bb68b20719c9473a5c0a4a69f3153759508508aa97605428f06c0fc5098f9a7e202f84fcb9cea3c9a644469538e5f05744729313962f0150e

Download Submit
memory/1208-32-0x00000000027A0000-0x0000000002839000-memory.dmp

Filesize
612KB

Download
memory/1208-20-0x0000000002040000-0x00000000020CA000-memory.dmp

Filesize
552KB

Download
memory/1208-40-0x00000000027A0000-0x0000000002839000-memory.dmp

Filesize
612KB

Download
memory/1208-35-0x00000000027A0000-0x0000000002839000-memory.dmp

Filesize
612KB

Download
memory/1208-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1208-19-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1208-28-0x0000000002040000-0x00000000020CA000-memory.dmp

Filesize
552KB

Download
memory/1208-26-0x0000000002040000-0x00000000020CA000-memory.dmp

Filesize
552KB

Download
memory/1208-36-0x00000000027A0000-0x0000000002839000-memory.dmp

Filesize
612KB

Download
memory/1208-24-0x0000000002040000-0x00000000020CA000-memory.dmp

Filesize
552KB

Download
memory/1208-22-0x0000000002040000-0x00000000020CA000-memory.dmp

Filesize
552KB

Download
memory/1208-30-0x0000000002040000-0x00000000020CA000-memory.dmp

Filesize
552KB

Download
memory/1208-31-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1208-34-0x00000000027A0000-0x0000000002839000-memory.dmp

Filesize
612KB

Download
memory/1580-0-0x0000000000470000-0x00000000004C8000-memory.dmp

Filesize
352KB

Download
memory/1580-1-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/1580-15-0x0000000000470000-0x00000000004C8000-memory.dmp

Filesize
352KB

Download
memory/1580-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download