Overview

overview

10

Static

static

3

9090e03828...cs.exe

windows7-x64

10

9090e03828...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 06:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9090e038284cbec1890e292282d46690_NeikiAnalytics.exe
  • Size 91KB
  • Sample240601-g2jrcsdb69
  • SHA256 312df760f50bd9900e5185e3d45de607acb6ad0037184ea911d64f732749e376
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9090e038284cbec1890e292282d46690_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9090e038284cbec1890e292282d46690_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4948
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4940
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3956
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4696
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3124
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2512
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1072
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CSRSS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
        • Size 91KB
        • SHA256 b0c872a0dcc8bd1110a0e4f4312d19bec8ef7b21104d9bd5385e802c5fed889b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LSASS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
        • Size 91KB
        • SHA256 f8e5d1b58665a56bf066ce174fd4e26a2e17527a82f832fd7b3ea93b27c75cd1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SERVICES.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
        • Size 91KB
        • SHA256 a17af879d0e41d8fb55c5b6adcca72f61a7b03a3415e6fad9f11518ba43d624c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SMSS.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
        • Size 91KB
        • SHA256 20b919e2a190f7449c770de72fe872fd8d3f680a2fbcf082a29d3a59835209ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WINLOGON.EXE
        • Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
        • Size 91KB
        • SHA256 e71fe7318b9c5271c9e62a3e22567ef08eb372b6daeedd8f9c17a788265285ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        winlogon.exe
        • Path C:\Users\Admin\AppData\Local\winlogon.exe
        • Size 91KB
        • SHA256 312df760f50bd9900e5185e3d45de607acb6ad0037184ea911d64f732749e376
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IExplorer.exe
        • Path C:\Windows\SysWOW64\IExplorer.exe
        • Size 91KB
        • SHA256 1ee13f0d2f33ac12bc8ad09849e61228e9023fd36b3f35e944cf36cf7732cf86
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xk.exe
        • Path C:\Windows\xk.exe
        • Size 91KB
        • SHA256 b6ee0dcf780337d6f31ed12b2d5632f1a419744d47e90109eb0a7a5c29304ea0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1072-149-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/2512-142-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/2512-139-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/2692-155-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/3124-135-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/3956-121-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/3956-116-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/4696-127-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/4940-112-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/4940-108-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/4948-0-0x0000000000400000-0x000000000042E000-memory.dmp
        Download

        memory/4948-156-0x0000000000400000-0x000000000042E000-memory.dmp
        Download