47d018e176a632e3c3a6f598a5064f22adbfe0d3a07d38e907338fb4f75bb294

Analysis

max time kernel
144s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe
Size 504KB
Sample240601-bd52sscg82
SHA256 47d018e176a632e3c3a6f598a5064f22adbfe0d3a07d38e907338fb4f75bb294
MD5 8740251aea5b31142dda0b39f8a72260
SHA1 7e090ad5bc9dc2f4d97636d1e08d5cf1774ee850
SHA512 b33fa9bb0806252f7a441fe5e4ae3be9d8ac6015c280d77c059cf6845a17ecfcf8af9d4e23e9c5df557efcd1c17f5e065c7b3c4e687aa35f1c90fd6521b5fb35
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2432	Explorrer.exe
2944	Explorrer.exe
388	Explorrer.exe

Loads dropped DLL 2 IoCs

pid	Process
5236	regsvr32.exe
1100	regsvr32.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4804-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4804-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/4804-15-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/files/0x000b000000023369-19.dat	upx
behavioral2/memory/2432-20-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/2432-27-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/2432-29-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral2/memory/2432-38-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\NoExplorer = "1"	regsvr32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 2432 set thread context of 2944	2432	Explorrer.exe	106
PID 2432 set thread context of 388	2432	Explorrer.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	760	WerFault.exe	108

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
760	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Approved Extensions	Explorrer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{3543619C-D563-43f7-95EA-4DA7E1CC396A} = 51667a6c4c1d3b1b003ad2d87fc9ac0780c431c2a3933e7f	Explorrer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\IE\\bho.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\ = "IE MANAGER"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe
5904	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe
2432	Explorrer.exe
2944	Explorrer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 4804 wrote to memory of 5904	4804	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	101
PID 5904 wrote to memory of 2432	5904	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	102
PID 5904 wrote to memory of 2432	5904	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	102
PID 5904 wrote to memory of 2432	5904	8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe	102
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 2944	2432	Explorrer.exe	106
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2432 wrote to memory of 388	2432	Explorrer.exe	107
PID 2944 wrote to memory of 760	2944	Explorrer.exe	108
PID 2944 wrote to memory of 760	2944	Explorrer.exe	108
PID 2944 wrote to memory of 760	2944	Explorrer.exe	108
PID 2944 wrote to memory of 760	2944	Explorrer.exe	108
PID 2944 wrote to memory of 760	2944	Explorrer.exe	108
PID 388 wrote to memory of 5236	388	Explorrer.exe	110
PID 388 wrote to memory of 5236	388	Explorrer.exe	110
PID 388 wrote to memory of 5236	388	Explorrer.exe	110
PID 388 wrote to memory of 1100	388	Explorrer.exe	112
PID 388 wrote to memory of 1100	388	Explorrer.exe	112
PID 388 wrote to memory of 1100	388	Explorrer.exe	112

C:\Users\Admin\AppData\Local\Temp\8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\8740251aea5b31142dda0b39f8a72260_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
    C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 272
        6⤵
        Program crash
        
        PID:4488
  - - C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
      "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:388
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        
        PID:5236
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
        5⤵
        Loads dropped DLL
        Installs/modifies Browser Helper Object
        Modifies registry class
        
        PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 760 -ip 760
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorrer.exe

Path C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
Size 504KB
SHA256 bd25d192080a289e2171d0cf827cd083055b4e2085a63d057d4b2cb92f3717f8
MD5 6d9f66a49bf3e8d28b7ef4bc08a29041
SHA1 3e36c487149d994b412195c63060d1017abd0674
SHA512 930d326861ffb42a599411828ddeef4fbbc86898fb28c80392b207357907f00245a62daf34e0cba7b14a5e31c507487af1158014657579fa00405d55428f2ba1
SSDEEP 12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bho.dll

Path C:\Users\Admin\AppData\Roaming\IE\bho.dll
Size 87KB
SHA256 976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5
MD5 49a92a33d1775b45b3bd45f8bec24585
SHA1 ea404af50bbdad5cbc9f95f4068bdc30c9fceff6
SHA512 7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f
SSDEEP 1536:ETw4mDklLqIaqhQ2MQXDn0Nzy8XTgUYV6uSXyV29fS1SWeITo:EmCLHaqWQXDn0NzutNtV29fS1HeITo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-90-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-62-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-170-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-34-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-37-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-60-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-77-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-81-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-59-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-61-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-88-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-63-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-64-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-51-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-49-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-48-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-47-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-46-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-45-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-44-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-43-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-42-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-39-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-52-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-87-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-96-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-95-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-94-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-93-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-92-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-91-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-65-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-66-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-86-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-67-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-89-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-85-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-84-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-83-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-82-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-80-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-79-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-78-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-76-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-75-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-74-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-73-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-72-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-71-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-70-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-69-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/388-68-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2432-20-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2432-38-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2432-29-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2432-27-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2944-167-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4804-6-0x0000000004340000-0x0000000004341000-memory.dmp

Download

memory/4804-5-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/4804-15-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4804-11-0x00000000056C0000-0x00000000056C1000-memory.dmp

Download

memory/4804-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4804-3-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/4804-7-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/5904-24-0x0000000000490000-0x0000000000559000-memory.dmp

Download

memory/5904-26-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/5904-8-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/5904-10-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads