Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe
-
Size
160KB
-
MD5
16f33103486a44e3fbc984bb2e24d560
-
SHA1
b0bebc288b6d5f5fb18f1e1c3b1d0f89449bbd7b
-
SHA256
99343d229dd14c2bd040955c6984373fa4b8738233cc90e1d3a4ddf378257af7
-
SHA512
820375e42a684a3c416dbc7310c72fec55e1e08431c8c95ace80554c306eaa6237bb82dc7dc4a40610e05396348c585dfebadd070c543c610dbb865e4d8bf6c1
-
SSDEEP
3072:fKy5hExmTzwhr1/a84HesWgsIAzRvwa7vUlX1p6SS4uBoA/LVzxISnAOFZDwFU0I:fJ5hEgTzaA+sWgsIORRIlX1p6SSoKVua
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeauya.exe -
Executes dropped EXE 1 IoCs
pid Process 2520 yeauya.exe -
Loads dropped DLL 2 IoCs
pid Process 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /E" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /v" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /G" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /Y" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /c" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /R" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /A" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /h" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /U" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /e" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /y" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /B" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /X" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /W" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /N" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /i" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /d" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /M" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /r" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /u" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /f" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /n" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /x" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /V" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /m" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /O" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /D" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /w" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /C" 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /P" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /I" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /S" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /F" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /t" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /q" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /T" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /b" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /j" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /g" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /l" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /J" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /L" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /H" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /Q" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /K" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /s" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /C" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /Z" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /p" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /a" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /z" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /k" yeauya.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeauya = "C:\\Users\\Admin\\yeauya.exe /o" yeauya.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe 2520 yeauya.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 2520 yeauya.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2520 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2520 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2520 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2520 1712 16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\16f33103486a44e3fbc984bb2e24d560_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\yeauya.exe"C:\Users\Admin\yeauya.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5365cd9d2901502ca75e457ef5160acdd
SHA1daa9fb48a5c76f34e71228eb5450bf02ffe135e9
SHA25677f2c0d9c6beaed7de475b7f1fe0b0bc5ef739de3f10a1ca7e2adb2c266b2cf7
SHA5127c1fb823731769376c69eaafc691356a2107bb3bc680eaa9b67791e5ac905c85142c3c425cbd54b125a383452c180828401cb5e6dc6e512043faddfecd091a28