Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 05:43

General

  • Target

    797cd2ef5bc6b5b41f8508e8d3051120_NeikiAnalytics.dll

  • Size

    157KB

  • MD5

    797cd2ef5bc6b5b41f8508e8d3051120

  • SHA1

    09936774ed803a7b72b86baa4144d27d58dc9d4f

  • SHA256

    ba0b188e2d49247864e1c709aa9b1467f57a2c73b484418217c1ad678f8645bc

  • SHA512

    971c16668ecaec4f127d61ed3af210237c23c536a650789fe8ee0c6537e872899e39111618337073877eedbc0179b02fc3d0176eb970355d23e1c40959decef8

  • SSDEEP

    3072:IMr6N9WfdNAbzEJ069VyZhDsHYZ3rDINcQR0n6ecZdGU1QLaLNmYqhPzxm18:IMqWfdNAPE+6yEYZ7DVQgsQLPzo18

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of UnmapMainImage 4 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\797cd2ef5bc6b5b41f8508e8d3051120_NeikiAnalytics.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\797cd2ef5bc6b5b41f8508e8d3051120_NeikiAnalytics.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\SysWOW64\rundll32mgrmgr.exe
          C:\Windows\SysWOW64\rundll32mgrmgr.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:2548
          • C:\Program Files (x86)\Microsoft\WaterMark.exe
            "C:\Program Files (x86)\Microsoft\WaterMark.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
                PID:2216
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\system32\svchost.exe
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1192
          • C:\Program Files (x86)\Microsoft\WaterMark.exe
            "C:\Program Files (x86)\Microsoft\WaterMark.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\system32\svchost.exe
              5⤵
              • Modifies WinLogon for persistence
              • Drops file in System32 directory
              • Drops file in Program Files directory
              PID:2844
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\system32\svchost.exe
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2240

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

      Filesize

      132KB

      MD5

      67701ba02451abf3bc53b8a165170fff

      SHA1

      45f4262def81d255c405e31ac3ab38b2e560583d

      SHA256

      397a4a3d2e376845f6d3816af275b19a59acc368dcb661f58093c5b3fc746f8e

      SHA512

      f2466f20831d0acd8b934c7bcc6eff08d1dc7543f354fe42859f1971bb581137d8c5ab86d0c6badea32706cbbc2ca2674e4edabd3a0a288d6a0e411c56e7d1af

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

      Filesize

      128KB

      MD5

      c506416a5dd5cbe6fc86cd6fb7585487

      SHA1

      33889abac18666814f0d3c61c5df7280ae2e5ebc

      SHA256

      b79816ae0b418e3dd1c50c8afade3c90f539152a0c81daa65374c1d1e4c30982

      SHA512

      9b4e8e338c9582cb07fe5e651bfce4cafefebae5277a1ed1809d02b03acf1a8316dc19d60e3b212b91c555fcd5ffa363fac5cb7502cef6ae441dd491bf398711

    • \Program Files (x86)\Microsoft\WaterMark.exe

      Filesize

      59KB

      MD5

      f2c8b7e238a07cce22920efb1c8645a6

      SHA1

      cd2af4b30add747e222f938206b78d7730fdf346

      SHA256

      6b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e

      SHA512

      c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699

    • \Windows\SysWOW64\rundll32mgr.exe

      Filesize

      122KB

      MD5

      c5255edf109342e3e1d1eb0990b2d094

      SHA1

      ba029b47b9b3a5ccccae3038d90382ec68a1dd44

      SHA256

      ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5

      SHA512

      6b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3

    • memory/1372-1-0x0000000010000000-0x000000001002B000-memory.dmp

      Filesize

      172KB

    • memory/1372-3-0x0000000000190000-0x00000000001C3000-memory.dmp

      Filesize

      204KB

    • memory/1372-10-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

    • memory/1372-11-0x0000000000190000-0x0000000000191000-memory.dmp

      Filesize

      4KB

    • memory/1372-12-0x0000000077930000-0x0000000077931000-memory.dmp

      Filesize

      4KB

    • memory/2264-24-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2264-52-0x0000000000416000-0x0000000000420000-memory.dmp

      Filesize

      40KB

    • memory/2264-25-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/2264-21-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2264-20-0x0000000000120000-0x0000000000143000-memory.dmp

      Filesize

      140KB

    • memory/2264-22-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2264-23-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2264-51-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2548-32-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2548-31-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/2548-33-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2548-50-0x0000000000401000-0x0000000000416000-memory.dmp

      Filesize

      84KB

    • memory/2548-48-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2548-49-0x0000000000416000-0x0000000000420000-memory.dmp

      Filesize

      40KB

    • memory/2656-82-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2656-70-0x00000000001E0000-0x00000000001E1000-memory.dmp

      Filesize

      4KB

    • memory/2656-156-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2656-54-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/2844-72-0x0000000020010000-0x0000000020022000-memory.dmp

      Filesize

      72KB

    • memory/2844-104-0x0000000020010000-0x0000000020022000-memory.dmp

      Filesize

      72KB

    • memory/2844-99-0x0000000020010000-0x0000000020022000-memory.dmp

      Filesize

      72KB

    • memory/2844-95-0x0000000020010000-0x0000000020022000-memory.dmp

      Filesize

      72KB

    • memory/2844-74-0x00000000000C0000-0x00000000000C1000-memory.dmp

      Filesize

      4KB

    • memory/2880-83-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2880-64-0x00000000001B0000-0x00000000001B1000-memory.dmp

      Filesize

      4KB

    • memory/2880-154-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2880-56-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB