Analysis
-
max time kernel
80s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 05:39
Static task
static1
Behavioral task
behavioral1
Sample
8f6e831066911623293e4657acd52720_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
8f6e831066911623293e4657acd52720_NeikiAnalytics.exe
-
Size
5.3MB
-
MD5
8f6e831066911623293e4657acd52720
-
SHA1
943a7c146e40a77291c3d73be682f33e10451290
-
SHA256
f29b794ab11e98235fa7ff143fb2552a4820680f4c402300bf94ad83fe5d6914
-
SHA512
8af50cacaed44b7d8701fd82d6d070bf8805151e3aa00ba1f09503626d0a1338d7d5023c605880fc670e352ca33c3ca0ee7c0d7f9aec241989bc655313ed9ea4
-
SSDEEP
98304:RcmetZo1we5eNHA6Qtu1btqbyrvRdpveLhBRcIIIAEBczweizIPYj:9vwsKuoxqbyzRdpvuRcNIdBczjej
Malware Config
Signatures
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral1/memory/672-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-34-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/672-41-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1944 powershell.exe 1604 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2640 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 476 Process not Found 1448 kjakmqdelduq.exe -
Loads dropped DLL 1 IoCs
pid Process 476 Process not Found -
resource yara_rule behavioral1/memory/672-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-34-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-40-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/672-41-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe kjakmqdelduq.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1448 set thread context of 1628 1448 kjakmqdelduq.exe 82 PID 1448 set thread context of 672 1448 kjakmqdelduq.exe 87 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2660 sc.exe 2396 sc.exe 2524 sc.exe 2044 sc.exe 1760 sc.exe 2580 sc.exe 1736 sc.exe 1368 sc.exe 2532 sc.exe 1684 sc.exe 2024 sc.exe 2428 sc.exe 2644 sc.exe 1660 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 60a73911e6b3da01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1944 powershell.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1964 8f6e831066911623293e4657acd52720_NeikiAnalytics.exe 1448 kjakmqdelduq.exe 1604 powershell.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 1448 kjakmqdelduq.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe 672 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1944 powershell.exe Token: SeShutdownPrivilege 2884 powercfg.exe Token: SeShutdownPrivilege 3060 powercfg.exe Token: SeShutdownPrivilege 2836 powercfg.exe Token: SeShutdownPrivilege 2832 powercfg.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeShutdownPrivilege 2736 powercfg.exe Token: SeShutdownPrivilege 2212 powercfg.exe Token: SeShutdownPrivilege 2728 powercfg.exe Token: SeShutdownPrivilege 2828 powercfg.exe Token: SeLockMemoryPrivilege 672 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2668 2756 cmd.exe 34 PID 2756 wrote to memory of 2668 2756 cmd.exe 34 PID 2756 wrote to memory of 2668 2756 cmd.exe 34 PID 2640 wrote to memory of 2328 2640 cmd.exe 61 PID 2640 wrote to memory of 2328 2640 cmd.exe 61 PID 2640 wrote to memory of 2328 2640 cmd.exe 61 PID 328 wrote to memory of 1592 328 cmd.exe 69 PID 328 wrote to memory of 1592 328 cmd.exe 69 PID 328 wrote to memory of 1592 328 cmd.exe 69 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 1628 1448 kjakmqdelduq.exe 82 PID 1448 wrote to memory of 672 1448 kjakmqdelduq.exe 87 PID 1448 wrote to memory of 672 1448 kjakmqdelduq.exe 87 PID 1448 wrote to memory of 672 1448 kjakmqdelduq.exe 87 PID 1448 wrote to memory of 672 1448 kjakmqdelduq.exe 87 PID 1448 wrote to memory of 672 1448 kjakmqdelduq.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6e831066911623293e4657acd52720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f6e831066911623293e4657acd52720_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1964 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:2668
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:2532
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2524
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2644
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2580
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:2428
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ROADPDXD"2⤵
- Launches sc.exe
PID:1736
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ROADPDXD" binpath= "C:\ProgramData\ypsqetvlruho\kjakmqdelduq.exe" start= "auto"2⤵
- Launches sc.exe
PID:1368
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2396
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ROADPDXD"2⤵
- Launches sc.exe
PID:2660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\8f6e831066911623293e4657acd52720_NeikiAnalytics.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2328
-
-
-
C:\ProgramData\ypsqetvlruho\kjakmqdelduq.exeC:\ProgramData\ypsqetvlruho\kjakmqdelduq.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:1592
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1760
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1684
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2044
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2024
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1660
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1628
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD58f6e831066911623293e4657acd52720
SHA1943a7c146e40a77291c3d73be682f33e10451290
SHA256f29b794ab11e98235fa7ff143fb2552a4820680f4c402300bf94ad83fe5d6914
SHA5128af50cacaed44b7d8701fd82d6d070bf8805151e3aa00ba1f09503626d0a1338d7d5023c605880fc670e352ca33c3ca0ee7c0d7f9aec241989bc655313ed9ea4