779380b0ed70c538d1260597473aa15e73d741675ff1f94e37a9ce1152d741c8

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe
Size

72KB
MD5

8ce265b58b913bf2a718cd36cb8b8560
SHA1

d71ffd77303f83d2cfef89b8778dc4893ada03fc
SHA256

779380b0ed70c538d1260597473aa15e73d741675ff1f94e37a9ce1152d741c8
SHA512

96d174dd7ecde61b5a61465368b208812e75cbc98ff6799f2743382ccaac20d868c0506cc5d9c5cf427ad4c07d6960fbac1cdf716a3d59205f2006ea8b6343af
SSDEEP

1536:xBoj3/OgHIerbSSuf9c/buo4iiugZb6hCPmXeu0XyxsdvDKcY3:noDvHDrbTuf9abJiugV6hyu0XyxsdvD2

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ilgoavoak.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}\StubPath = "C:\\Windows\\system32\\idkooxap.exe"	ilgoavoak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}	ilgoavoak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50554D41-5254-4e52-5055-4D4152544e52}\IsInstalled = "1"	ilgoavoak.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ilgoavoak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\otdener.exe"	ilgoavoak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ilgoavoak.exe

Executes dropped EXE 2 IoCs

pid	Process
2656	ilgoavoak.exe
2692	ilgoavoak.exe

Loads dropped DLL 3 IoCs

pid	Process
2400	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe
2400	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe
2656	ilgoavoak.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ilgoavoak.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ilgoavoak.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ilgoavoak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ilgoavoak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ilgoavoak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\rboneap-ukoas.dll"	ilgoavoak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ilgoavoak.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\otdener.exe	ilgoavoak.exe
File created	C:\Windows\SysWOW64\rboneap-ukoas.dll	ilgoavoak.exe
File opened for modification	C:\Windows\SysWOW64\ilgoavoak.exe	ilgoavoak.exe
File created	C:\Windows\SysWOW64\idkooxap.exe	ilgoavoak.exe
File opened for modification	C:\Windows\SysWOW64\rboneap-ukoas.dll	ilgoavoak.exe
File opened for modification	C:\Windows\SysWOW64\ilgoavoak.exe	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\ilgoavoak.exe	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\otdener.exe	ilgoavoak.exe
File opened for modification	C:\Windows\SysWOW64\idkooxap.exe	ilgoavoak.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2692	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe
2656	ilgoavoak.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	ilgoavoak.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2656	2400	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe	28
PID 2400 wrote to memory of 2656	2400	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe	28
PID 2400 wrote to memory of 2656	2400	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe	28
PID 2400 wrote to memory of 2656	2400	8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe	28
PID 2656 wrote to memory of 428	2656	ilgoavoak.exe	5
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 2692	2656	ilgoavoak.exe	29
PID 2656 wrote to memory of 2692	2656	ilgoavoak.exe	29
PID 2656 wrote to memory of 2692	2656	ilgoavoak.exe	29
PID 2656 wrote to memory of 2692	2656	ilgoavoak.exe	29
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21
PID 2656 wrote to memory of 1168	2656	ilgoavoak.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1168
- C:\Users\Admin\AppData\Local\Temp\8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\8ce265b58b913bf2a718cd36cb8b8560_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\ilgoavoak.exe
    "C:\Windows\SysWOW64\ilgoavoak.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\ilgoavoak.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\idkooxap.exe

Filesize
72KB

MD5
064692d9cdeb7f98127406f03f0e6d2b

SHA1
76b12695370d6a68c4b97424bb6208a7e96781d6

SHA256
3375cdddf172136c7513102736e04cfd5e775ad4c599f310a72d6b331969f1a4

SHA512
c997f668aee05a7dca2f7b1385ad5301cc8e30c736400e52c70a55004f2ef4ead1d1f6a8246ba9f8ddcdaa075f5e386d171b8c9e0de49f0fa84fcee58c4efa1f

Download Submit
C:\Windows\SysWOW64\otdener.exe

Filesize
73KB

MD5
ec12f8cbb7c0068a456d5cbdf1497eb6

SHA1
48542ded1f9caaa33a656e7088cb7861efb7b940

SHA256
d92b2a8b5a5b67872900bd04f4190dbba68ceb06f3afc0bfaca26239bab2563b

SHA512
e6654adab06a68bec85c18d45dc938ee8769bc5fa48037d8afd580e976a9f6e483e479997bb2b3f9563f792bdc80c58495f88f36e06999539bb826728a64de3e

Download Submit
C:\Windows\SysWOW64\rboneap-ukoas.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\ilgoavoak.exe

Filesize
70KB

MD5
86cbefd1f2091f741159830308ced2ad

SHA1
64c518c6ebf8db6839d4a9bd866c231b7e6b394c

SHA256
c40195cebc0278d21312cb8ffbda264dc04d844ec04efa4cea775fbe96c2f3a7

SHA512
6bd1d023a2c8853410878e894b8317bd9748be97937973aefdc9e235cce41321cea75bd96bcd132f9bf413121e556ed907dba8a6b90c8b241847028b228eeefb

Download Submit
memory/2400-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2656-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2692-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download