Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
submitted
31-05-2024 01:02
Static task
static1
Behavioral task
behavioral1
Sample
707408e05240397500c84f75c68347f0_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
707408e05240397500c84f75c68347f0_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
707408e05240397500c84f75c68347f0
-
SHA1
c90cfafc9d341500bba9df2023dbb9e6ae0cc55d
-
SHA256
5ab7b5a51e66d8e92c78a6e715bc401bec1c095a8e3e8dbbc602b3ba3d03ffb6
-
SHA512
8d3352cfa9ca2fec3a613b69bf5b0d6c512cbfa985d0ec22ab3144a6b36816ec4c5cb541998a6e0111cc454bd6b2010f31eda205e1e96b4e2630b6f227bd20b9
-
SSDEEP
24576:DnsJ39LyjbJkQFMhmC+6GD9hjLHZiXrHXHkrq:DnsHyjtk2MYC5GDrHY7H0O
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Ramnit family
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 5 IoCs
pid Process 856 ._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 2308 ._cache_707408e05240397500c84f75c68347f0_NeikiAnalyticsmgr.exe 1724 Synaptics.exe 1284 ._cache_Synaptics.exe 2188 ._cache_Synapticsmgr.exe -
Loads dropped DLL 2 IoCs
pid Process 2308 ._cache_707408e05240397500c84f75c68347f0_NeikiAnalyticsmgr.exe 2188 ._cache_Synapticsmgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/2308-72-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 4576 2308 WerFault.exe 85 5048 856 WerFault.exe 84 4196 2188 WerFault.exe 93 4348 1284 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_707408e05240397500c84f75c68347f0_NeikiAnalyticsmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synapticsmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4332 wrote to memory of 856 4332 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 84 PID 4332 wrote to memory of 856 4332 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 84 PID 4332 wrote to memory of 856 4332 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 84 PID 856 wrote to memory of 2308 856 ._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 85 PID 856 wrote to memory of 2308 856 ._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 85 PID 856 wrote to memory of 2308 856 ._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 85 PID 4332 wrote to memory of 1724 4332 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 87 PID 4332 wrote to memory of 1724 4332 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 87 PID 4332 wrote to memory of 1724 4332 707408e05240397500c84f75c68347f0_NeikiAnalytics.exe 87 PID 1724 wrote to memory of 1284 1724 Synaptics.exe 92 PID 1724 wrote to memory of 1284 1724 Synaptics.exe 92 PID 1724 wrote to memory of 1284 1724 Synaptics.exe 92 PID 1284 wrote to memory of 2188 1284 ._cache_Synaptics.exe 93 PID 1284 wrote to memory of 2188 1284 ._cache_Synaptics.exe 93 PID 1284 wrote to memory of 2188 1284 ._cache_Synaptics.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\707408e05240397500c84f75c68347f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\707408e05240397500c84f75c68347f0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_707408e05240397500c84f75c68347f0_NeikiAnalytics.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\._cache_707408e05240397500c84f75c68347f0_NeikiAnalyticsmgr.exeC:\Users\Admin\AppData\Local\Temp\._cache_707408e05240397500c84f75c68347f0_NeikiAnalyticsmgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 4804⤵
- Program crash
PID:4576
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 7003⤵
- Program crash
PID:5048
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synapticsmgr.exeC:\Users\Admin\AppData\Local\Temp\._cache_Synapticsmgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 5165⤵
- Program crash
PID:4196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 7004⤵
- Program crash
PID:4348
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 856 -ip 8561⤵PID:2400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2308 -ip 23081⤵PID:3020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2188 -ip 21881⤵PID:3852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1284 -ip 12841⤵PID:3872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5707408e05240397500c84f75c68347f0
SHA1c90cfafc9d341500bba9df2023dbb9e6ae0cc55d
SHA2565ab7b5a51e66d8e92c78a6e715bc401bec1c095a8e3e8dbbc602b3ba3d03ffb6
SHA5128d3352cfa9ca2fec3a613b69bf5b0d6c512cbfa985d0ec22ab3144a6b36816ec4c5cb541998a6e0111cc454bd6b2010f31eda205e1e96b4e2630b6f227bd20b9
-
Filesize
433KB
MD5720fa5986135dab6d54371dcdec7524f
SHA1ab9a32250e9d9ef21dd4723384933247ad3d0123
SHA256801492c7185ce584fb498c5ed7de350b9d6b56159202203031c8e33102d1dbc1
SHA5128e25a7367fb11d95c442b7755058504ed089fd52e1ca0caab8b806c1df44ebaf55b308fff0f5817adebd403ec99eb89e9036bf963d72025ac9fe07026c3606f9
-
Filesize
184KB
MD51d92c741bc5b2d34dcd0a0265ab54275
SHA1a160982825420567c15f6c11f777cb4ccbe69bb8
SHA2563aab3cf37efd4c034da13a0d7ba8725f49a21d227e05f3bba91d8d36350f4a67
SHA5121da728dba6383e0e9fc51370f8fb782a15e724b57b952d952e4c719f81d517a56035b1e9496da3d7f9bf79af0a4bd5caa8a351ca60f40d637da3648224944b94
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219