Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
02/06/2024, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe
- Size 90KB
- Sample240602-2hrm3she5x
- SHA256 074e91ad0acdef9cd59c79633eb0de96c5b5d933eb3eac87388e6f8915073da7
- MD5 77b990a3474f3595287db4f9eec6f9d0
- SHA1 ef2bb72c06f32c8f43a91716ccbf8f5d61fa8272
- SHA512 99eb3b15cfc547664464e49a115649edecbe45a1fe8f8c0f14eedc0fa603b0b20f071299be8c96f94c998239f458fbeab65c3ca306213604cb2c10ef8f6d179f
- SSDEEP 1536:bfmto48HyF8e/O+TtSv6DhjFEA5n6qtvmzrRptAi858J8MGu1v3i6EG:X4y3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zaerae.exe - Executes dropped EXE 1 IoCs
pid Process 1208 zaerae.exe - Loads dropped DLL 2 IoCs
pid Process 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /p" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /b" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /k" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /o" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /f" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /w" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /g" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /s" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /l" 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /l" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /j" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /r" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /y" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /m" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /e" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /c" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /i" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /d" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /v" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /z" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /u" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /h" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /t" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /x" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /n" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /q" zaerae.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaerae = "C:\\Users\\Admin\\zaerae.exe /a" zaerae.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe 1208 zaerae.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 1208 zaerae.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1208 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 1208 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 1208 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 28 PID 3012 wrote to memory of 1208 3012 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\zaerae.exe"C:\Users\Admin\zaerae.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\zaerae.exe
- Size 90KB
- SHA256 fba7c4f4d9d2d9e60c594172a00f1b5c19a43bb7a60beda431982e65fca0f5e7
- MD5 1a892e157a8b8f9f44d7de8c359a0b05
- SHA1 b8b7ee3ff281e2c4c0037f11bc3f47c921743fb0
- SHA512 ebf86dfec1810cdea75d4c976ca7a6f0b6f3fd3c8a8d978fda91ce4152d97b66af85d6b3ba24f2321e576816c6b782aa75d3da7743b8f5fe23fe946d9e90b5ae
- SSDEEP 1536:bXmto4FFyF8e/O+TtSv6DhjFEA5n6qtvmzrRptAi858J8MGu1v3i6EG:H4FD3
- MD5 SHA1 SHA512 SSDEEP