473798b0ff65aee4bce5e0b5e72bf914628ab3d51b75930811c76d63300c288a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe
Size 70KB
Sample240601-d4drcagd8t
SHA256 473798b0ff65aee4bce5e0b5e72bf914628ab3d51b75930811c76d63300c288a
MD5 8be7d9e47a089fc11cc197174ec93b60
SHA1 ad2e34447d465cd7b66eb55778cc8186fedf6581
SHA512 b238ba670569b413830132614dda2932f16454a737634b546359314fc659917f14fd14923108c27b2e9b338fa6d63e21be29a2e57aa458e16acb4a98c3383387
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Au:Olg35GTslA5t3/w8d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	uvruxan.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\IsInstalled = "1"	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F41494C-5643-4e59-4F41-494C56434e59}\StubPath = "C:\\Windows\\system32\\itsoakid.exe"	uvruxan.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\irtoonir-efoab.exe"	uvruxan.exe

Executes dropped EXE 2 IoCs

pid	Process
2220	uvruxan.exe
4760	uvruxan.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	uvruxan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	uvruxan.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	uvruxan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\asfigak.dll"	uvruxan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	uvruxan.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\itsoakid.exe	uvruxan.exe
File opened for modification	C:\Windows\SysWOW64\uvruxan.exe	uvruxan.exe
File opened for modification	C:\Windows\SysWOW64\asfigak.dll	uvruxan.exe
File created	C:\Windows\SysWOW64\asfigak.dll	uvruxan.exe
File opened for modification	C:\Windows\SysWOW64\uvruxan.exe	8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\uvruxan.exe	8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\irtoonir-efoab.exe	uvruxan.exe
File created	C:\Windows\SysWOW64\irtoonir-efoab.exe	uvruxan.exe
File opened for modification	C:\Windows\SysWOW64\itsoakid.exe	uvruxan.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
4760	uvruxan.exe
4760	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe
2220	uvruxan.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe
Token: SeDebugPrivilege	2220	uvruxan.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2220	4616	8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe	91
PID 4616 wrote to memory of 2220	4616	8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe	91
PID 4616 wrote to memory of 2220	4616	8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe	91
PID 2220 wrote to memory of 4760	2220	uvruxan.exe	92
PID 2220 wrote to memory of 4760	2220	uvruxan.exe	92
PID 2220 wrote to memory of 4760	2220	uvruxan.exe	92
PID 2220 wrote to memory of 616	2220	uvruxan.exe	5
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57
PID 2220 wrote to memory of 3360	2220	uvruxan.exe	57

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Temp\8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\8be7d9e47a089fc11cc197174ec93b60_NeikiAnalytics.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\uvruxan.exe
    "C:\Windows\system32\uvruxan.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\SysWOW64\uvruxan.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asfigak.dll

Path C:\Windows\SysWOW64\asfigak.dll
Size 5KB
SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
MD5 f37b21c00fd81bd93c89ce741a88f183
SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

irtoonir-efoab.exe

Path C:\Windows\SysWOW64\irtoonir-efoab.exe
Size 74KB
SHA256 20d8fdf531f51efc9a77bd038cbd63ddea9724f56d2f03f219c55577435180f4
MD5 23747a6160babf6a63d08fa9b0415f8f
SHA1 2ede35a81707e68eff82b1f1da9a676ef2b6181f
SHA512 c6913fb3e69616f99ee60e1fec98d6e56450ee64f7f3e1ba6c21fd7c5c2bd98ba08fa745d89b8783bf09c43651097c51a5e0e7b837dd11f902e550c22dac5348
SSDEEP 1536:1bPd6aXUhvYMwRHoly48kXA9pD9fWZ/bwPsaqPc1KqvV2mU:Ji2Mt8kQ9p9fSbwPEPQ1/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

itsoakid.exe

Path C:\Windows\SysWOW64\itsoakid.exe
Size 73KB
SHA256 fcb1eb4438d333885710bb4a3edc28306960ec906ef3cca067c568a814093b9e
MD5 dae5741bc9c9fe44a90b0484d59aa376
SHA1 30c0320a23e30aa1c4c7a49136ccb37e2f24e656
SHA512 1590b8c156d48cbea93d043bb1969a18e3a3d41df8fa8eab2e41b28ef163e561d5187f6bc69fa5e6138fb51b26cb598d46a20336b2cc6e8c38478f3bb4d0d5a3
SSDEEP 768:x/nlrF9TAbYmFr1BndWdhKjJFJLLeTYSOmPPxfXjGca8Iaxqm4Ts9s5qCfRpXMRd:x5FNAlTnd+5rO0PxfXZVBZq5qYXMEi
MD5 SHA1 SHA512 SSDEEP

Submit Download

uvruxan.exe

Path C:\Windows\SysWOW64\uvruxan.exe
Size 70KB
SHA256 473798b0ff65aee4bce5e0b5e72bf914628ab3d51b75930811c76d63300c288a
MD5 8be7d9e47a089fc11cc197174ec93b60
SHA1 ad2e34447d465cd7b66eb55778cc8186fedf6581
SHA512 b238ba670569b413830132614dda2932f16454a737634b546359314fc659917f14fd14923108c27b2e9b338fa6d63e21be29a2e57aa458e16acb4a98c3383387
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Au:Olg35GTslA5t3/w8d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2220-49-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4616-6-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4760-50-0x0000000000400000-0x0000000000414000-memory.dmp

Download