908f31ed01990097a2e28dc6d2ba85ca4b93f3a8025c69606e496e1a98b655e3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
Size 1.4MB
Sample240601-fwmemabf75
SHA256 908f31ed01990097a2e28dc6d2ba85ca4b93f3a8025c69606e496e1a98b655e3
MD5 8ec12c29ed89637f8f80a1a038afa200
SHA1 8ad80f8580569fc986c1d5cc6559fb27a0bf302e
SHA512 1b4f89bb5c117b1191568d2bc48ad353820eefa876e737ee22ae942d84e9bc16f88be8271fc19c1d600aad6496f7db0acb03234798f5485b29803e3242ed2b8c
SSDEEP 6144:gDCwfADCwfyDDCwfqDCwfyDDCwfaz6DCwfADCwfyDDCwfqDCwfyDDCwfazQ:g7A7yD7q7yD7az67A7yD7q7yD7azQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YCLEXTAL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YCLEXTAL = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\YCLEXTAL = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2080	avscan.exe
3856	avscan.exe
4920	hosts.exe
3364	hosts.exe
1284	avscan.exe
4856	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\windows\W_X_C.vbs	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
File created	\??\c:\windows\W_X_C.bat	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
2000	REG.exe
1588	REG.exe
1736	REG.exe
5092	REG.exe
1904	REG.exe
2380	REG.exe
4308	REG.exe
4924	REG.exe
3500	REG.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2080	avscan.exe
4920	hosts.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
2080	avscan.exe
3856	avscan.exe
4920	hosts.exe
3364	hosts.exe
1284	avscan.exe
4856	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2380	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	82
PID 2104 wrote to memory of 2380	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	82
PID 2104 wrote to memory of 2380	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	82
PID 2104 wrote to memory of 2080	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	84
PID 2104 wrote to memory of 2080	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	84
PID 2104 wrote to memory of 2080	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	84
PID 2080 wrote to memory of 3856	2080	avscan.exe	85
PID 2080 wrote to memory of 3856	2080	avscan.exe	85
PID 2080 wrote to memory of 3856	2080	avscan.exe	85
PID 2080 wrote to memory of 2176	2080	avscan.exe	86
PID 2080 wrote to memory of 2176	2080	avscan.exe	86
PID 2080 wrote to memory of 2176	2080	avscan.exe	86
PID 2104 wrote to memory of 3312	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	87
PID 2104 wrote to memory of 3312	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	87
PID 2104 wrote to memory of 3312	2104	8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe	87
PID 3312 wrote to memory of 4920	3312	cmd.exe	91
PID 3312 wrote to memory of 4920	3312	cmd.exe	91
PID 3312 wrote to memory of 4920	3312	cmd.exe	91
PID 2176 wrote to memory of 3364	2176	cmd.exe	90
PID 2176 wrote to memory of 3364	2176	cmd.exe	90
PID 2176 wrote to memory of 3364	2176	cmd.exe	90
PID 4920 wrote to memory of 1284	4920	hosts.exe	93
PID 4920 wrote to memory of 1284	4920	hosts.exe	93
PID 4920 wrote to memory of 1284	4920	hosts.exe	93
PID 3312 wrote to memory of 2596	3312	cmd.exe	94
PID 3312 wrote to memory of 2596	3312	cmd.exe	94
PID 3312 wrote to memory of 2596	3312	cmd.exe	94
PID 4920 wrote to memory of 1376	4920	hosts.exe	96
PID 4920 wrote to memory of 1376	4920	hosts.exe	96
PID 4920 wrote to memory of 1376	4920	hosts.exe	96
PID 2176 wrote to memory of 1032	2176	cmd.exe	95
PID 2176 wrote to memory of 1032	2176	cmd.exe	95
PID 2176 wrote to memory of 1032	2176	cmd.exe	95
PID 1376 wrote to memory of 4856	1376	cmd.exe	98
PID 1376 wrote to memory of 4856	1376	cmd.exe	98
PID 1376 wrote to memory of 4856	1376	cmd.exe	98
PID 1376 wrote to memory of 5100	1376	cmd.exe	99
PID 1376 wrote to memory of 5100	1376	cmd.exe	99
PID 1376 wrote to memory of 5100	1376	cmd.exe	99
PID 2080 wrote to memory of 2000	2080	avscan.exe	108
PID 2080 wrote to memory of 2000	2080	avscan.exe	108
PID 2080 wrote to memory of 2000	2080	avscan.exe	108
PID 4920 wrote to memory of 4308	4920	hosts.exe	110
PID 4920 wrote to memory of 4308	4920	hosts.exe	110
PID 4920 wrote to memory of 4308	4920	hosts.exe	110
PID 2080 wrote to memory of 1588	2080	avscan.exe	112
PID 2080 wrote to memory of 1588	2080	avscan.exe	112
PID 2080 wrote to memory of 1588	2080	avscan.exe	112
PID 4920 wrote to memory of 4924	4920	hosts.exe	114
PID 4920 wrote to memory of 4924	4920	hosts.exe	114
PID 4920 wrote to memory of 4924	4920	hosts.exe	114
PID 2080 wrote to memory of 1736	2080	avscan.exe	116
PID 2080 wrote to memory of 1736	2080	avscan.exe	116
PID 2080 wrote to memory of 1736	2080	avscan.exe	116
PID 4920 wrote to memory of 3500	4920	hosts.exe	118
PID 4920 wrote to memory of 3500	4920	hosts.exe	118
PID 4920 wrote to memory of 3500	4920	hosts.exe	118
PID 2080 wrote to memory of 5092	2080	avscan.exe	120
PID 2080 wrote to memory of 5092	2080	avscan.exe	120
PID 2080 wrote to memory of 5092	2080	avscan.exe	120
PID 4920 wrote to memory of 1904	4920	hosts.exe	122
PID 4920 wrote to memory of 1904	4920	hosts.exe	122
PID 4920 wrote to memory of 1904	4920	hosts.exe	122

C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ec12c29ed89637f8f80a1a038afa200_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\avscan.exe
  C:\Users\Admin\AppData\Local\Temp\avscan.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\avscan.exe
    C:\Users\Admin\AppData\Local\Temp\avscan.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\windows\hosts.exe
      C:\windows\hosts.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3364
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
      4⤵
      Adds policy Run key to start application
      PID:1032
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2000
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1588
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1736
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\windows\hosts.exe
    C:\windows\hosts.exe
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\avscan.exe
      C:\Users\Admin\AppData\Local\Temp\avscan.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\windows\hosts.exe
        
        C:\windows\hosts.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4856
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
        5⤵
        Adds policy Run key to start application
        
        PID:5100
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4308
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:4924
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:3500
  - - C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      4⤵
      Modifies registry key
      PID:1904
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
    3⤵
    - Adds policy Run key to start application
    PID:2596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avscan.exe

Path C:\Users\Admin\AppData\Local\Temp\avscan.exe
Size 1.4MB
SHA256 fc567af306ec4b0d4a3134f1a435d74874b0a0366513400acce3b10eae6e37a8
MD5 0670f3b7e3d0101cdbf9c0d55187af1f
SHA1 797dad745fcece62f77f84e93f85228a5226e330
SHA512 2684b213310d536d1efb4a35af74a9de5cf6b57be09976f21a5482ef64b41d9ccb24d9f998ce4b3799865c1718f92af3b78dbe0fbd37132ef59efbfc5117a066
SSDEEP 6144:gDCwfADCwfyDDCwfqDCwfyDDCwfaz6DCwfADCwfyDDCwfqDCwfyDDCwfazr:g7A7yD7q7yD7az67A7yD7q7yD7azr
MD5 SHA1 SHA512 SSDEEP

Submit Download

W_X_C.vbs

Path C:\Windows\W_X_C.vbs
Size 195B
SHA256 e81b685ef5500a016e284eedd8ced163f4900042894e0728ef1cfe583daaf33c
MD5 5a0bc75af86d7b19590f2893967c001d
SHA1 ef84fda77229bb4da29ec18aca2c6b334a640b79
SHA512 4046f66d5f365a5b0bb398d9e62c25277d91010f8fe5a722460df642dedb9986476a8dfc4d16d846c08387a3a4f988b810f2947f5a09b351f21673c0cb5532a3
MD5 SHA1 SHA512

Submit Download

hosts.exe

Path C:\Windows\hosts.exe
Size 1.4MB
SHA256 82509628bf116e52b2c5ad0b644b72a270a4f887eb28054d9cdaabe11b8bb841
MD5 ef1d02e0393807b4f64f3dff94ed6821
SHA1 269f0c2d2cd2de16a5daf21317108eb6bbbe99fb
SHA512 276eda2e920f05f5b9c6c07966ad8061ccfce1e4f52652d7365021be6bfed5c1d787d9dae9855cf3c182cce53fea589192eebc6c39f47e8985de9a4d7f436df9
SSDEEP 6144:gDCwfADCwfyDDCwfqDCwfyDDCwfaz6DCwfADCwfyDDCwfqDCwfyDDCwfaz9:g7A7yD7q7yD7az67A7yD7q7yD7az9
MD5 SHA1 SHA512 SSDEEP

Submit Download

W_X_C.bat

Path \??\c:\windows\W_X_C.bat
Size 336B
SHA256 d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
MD5 4db9f8b6175722b62ececeeeba1ce307
SHA1 3b3ba8414706e72a6fa19e884a97b87609e11e47
SHA512 1d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads