Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
1dcc98d28fd5b2fbbcb886bf9b466ce0
-
SHA1
841cdd3cea72ffaaab335c2bf17662a3885504d6
-
SHA256
032a26d0a5ac275a5f2a30f15e5a2f5f45033877d9925c105f4055f2a4f5b2a6
-
SHA512
bda4d66428d81608cdd4d8926a2416c604da7a85b1b86f77ffb35e3d5d69927732e034c0347b67e0078d8dbf5a97e54a4e0748fa5c663953a72d0d84a8b91e56
-
SSDEEP
1536:vN1g8r8QOkcopP8b7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:ykcop2JJjmLM3zRJWZsXy4Jd
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tdgub.exe -
Executes dropped EXE 1 IoCs
pid Process 1964 tdgub.exe -
Loads dropped DLL 2 IoCs
pid Process 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\tdgub = "C:\\Users\\Admin\\tdgub.exe" tdgub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe 1964 tdgub.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 1964 tdgub.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1964 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 28 PID 2308 wrote to memory of 1964 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 28 PID 2308 wrote to memory of 1964 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 28 PID 2308 wrote to memory of 1964 2308 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 28 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27 PID 1964 wrote to memory of 2308 1964 tdgub.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\tdgub.exe"C:\Users\Admin\tdgub.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5a25fc4e19493a7bc88601b91170a33b7
SHA1dc90b02ba1ef3b3c760df31d014e00e03e8fdfc0
SHA2567b0d5380a24d047b40f80dacecdc47bd127aa6e6d060e56f945f4e5e0ca4337a
SHA512cf9376380524e629bf388919e86f41530b76b0678cbf4052426399840ed50c9d5cd01ef490d841e22483d85c4895869feff2668d0e8b2b8d9530e62e692c3901