Analysis
- max time kernel
150s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 06:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe
- Size 5.6MB
- Sample240601-g8xa2add77
- SHA256 fc7d517de56b5d3dd681bc82f080d6b253093718d12ab0490a31c2b15f24de22
- MD5 90d510fc8009487e1fb69c0d34f2ebe0
- SHA1 2d4a058d715f2a3e3d321bd842af58f706de4a65
- SHA512 c5b1b644ffb0dcaca81383e85081da1ffbd5a37b48c45b29ff78636136ecbe2094ebddca7df284894834905f4eaf8e244169b85e5196a2187d1434a9a38caad5
- SSDEEP 49152:st8iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ7J:dihyoPgbInQEHY3N3sNfxLlC1DxeR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Executes dropped EXE 6 IoCs
pid Process 640 90d510fc8009487e1fb69c0d34f2ebe0_neikianalytics.exe 540 icsys.icn.exe 4268 explorer.exe 3708 spoolsv.exe 4812 svchost.exe 2464 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe 540 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4268 explorer.exe 4812 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 540 icsys.icn.exe 540 icsys.icn.exe 4268 explorer.exe 4268 explorer.exe 3708 spoolsv.exe 3708 spoolsv.exe 4812 svchost.exe 4812 svchost.exe 2464 spoolsv.exe 2464 spoolsv.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3228 wrote to memory of 640 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 83 PID 3228 wrote to memory of 640 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 83 PID 3228 wrote to memory of 640 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 83 PID 3228 wrote to memory of 540 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 84 PID 3228 wrote to memory of 540 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 84 PID 3228 wrote to memory of 540 3228 90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe 84 PID 540 wrote to memory of 4268 540 icsys.icn.exe 86 PID 540 wrote to memory of 4268 540 icsys.icn.exe 86 PID 540 wrote to memory of 4268 540 icsys.icn.exe 86 PID 4268 wrote to memory of 3708 4268 explorer.exe 87 PID 4268 wrote to memory of 3708 4268 explorer.exe 87 PID 4268 wrote to memory of 3708 4268 explorer.exe 87 PID 3708 wrote to memory of 4812 3708 spoolsv.exe 88 PID 3708 wrote to memory of 4812 3708 spoolsv.exe 88 PID 3708 wrote to memory of 4812 3708 spoolsv.exe 88 PID 4812 wrote to memory of 2464 4812 svchost.exe 89 PID 4812 wrote to memory of 2464 4812 svchost.exe 89 PID 4812 wrote to memory of 2464 4812 svchost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\90d510fc8009487e1fb69c0d34f2ebe0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\users\admin\appdata\local\temp\90d510fc8009487e1fb69c0d34f2ebe0_neikianalytics.exec:\users\admin\appdata\local\temp\90d510fc8009487e1fb69c0d34f2ebe0_neikianalytics.exe2⤵
- Executes dropped EXE
PID:640
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\90d510fc8009487e1fb69c0d34f2ebe0_neikianalytics.exe
- Size 5.5MB
- SHA256 db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
- MD5 9d8649afd4141d960b6545998fbc423b
- SHA1 3ddd700caaebab0a9d2ed640f235d4b716a505de
- SHA512 0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
- SSDEEP 49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 37ddaa0c466d1103f7eba6f97c2e0acb6f0f58d2f334306b7df023ce9e949d82
- MD5 c1028374c1552b8fcec522f31860ca21
- SHA1 fb8c7d0e8bc2dae1474ae1c601ade591fc84540d
- SHA512 e7bd3821a238af8a8e182ac8d434b64abfee3cbbbecd79c72d82c35d4e391055c2a6e923ad5a21b720b4348d85aa2fc129f7cdb49680632fc07f73c4a2921a3e
- SSDEEP 3072:XVqoCl/YgjxEufVU0TbTyDDalFPWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:XsLqdufVUNDa8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 50331d80eae189b23fbdd186a373e37bda962f6320f234f21a4c49750ab06bd4
- MD5 21cf46a15bf34c4ba4873386d0527b4c
- SHA1 6f404a9f9829eef5b4a6388caca64ba594adc59c
- SHA512 15e4b289743707c0e1edacae7458595a073e40a9fba72558d92ab6c32efcbff23df48e7e9f222f9e828582437ccc7f2fa79e44a028f5a727a5a3ce59f926aa0e
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgqM:XVqoCl/YgjxEufVU0TbTyDDalFM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 7065421d62cc655c7d5c6a96fecae2e182cca57dcb908cc85eb69f1aab0ff42e
- MD5 e5ef02da55686e26e399b019fe69b07f
- SHA1 d9d5a11798481508ea58658671286437f30bd838
- SHA512 63da8eef71e59358bd3da7fb14fc75d95a19b8bddeec573ad7579193a182b0b0212304544a163d9d5776c3b0dfd496527964312e7b33154631e05eb20bbe26bb
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgqz:XVqoCl/YgjxEufVU0TbTyDDalFz
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\resources\themes\explorer.exe
- Size 135KB
- SHA256 4f6aba7e5870930b520d4d38dc6653b381042ff7e390262bbb286242b9ea27f6
- MD5 7a551712a8a14bd42ebd76c5bc954cd8
- SHA1 b62badc7ca687c93797d801ff2ece385a6289566
- SHA512 3a3e969c15b32a0673213bf6951764bec5399404b7bdb7ed112e95fe72b25027affdb019e2922140ade33389227717bf4d47b967a6a3b79ea7a7f4ab8b997d15
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbgqM:XVqoCl/YgjxEufVU0TbTyDDalFM
- MD5 SHA1 SHA512 SSDEEP