Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe
-
Size
53KB
-
MD5
1dcc98d28fd5b2fbbcb886bf9b466ce0
-
SHA1
841cdd3cea72ffaaab335c2bf17662a3885504d6
-
SHA256
032a26d0a5ac275a5f2a30f15e5a2f5f45033877d9925c105f4055f2a4f5b2a6
-
SHA512
bda4d66428d81608cdd4d8926a2416c604da7a85b1b86f77ffb35e3d5d69927732e034c0347b67e0078d8dbf5a97e54a4e0748fa5c663953a72d0d84a8b91e56
-
SSDEEP
1536:vN1g8r8QOkcopP8b7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:ykcop2JJjmLM3zRJWZsXy4Jd
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keiol.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1208 keiol.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiol = "C:\\Users\\Admin\\keiol.exe" keiol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe 1208 keiol.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2840 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 1208 keiol.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 1208 2840 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 91 PID 2840 wrote to memory of 1208 2840 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 91 PID 2840 wrote to memory of 1208 2840 1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe 91 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82 PID 1208 wrote to memory of 2840 1208 keiol.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1dcc98d28fd5b2fbbcb886bf9b466ce0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\keiol.exe"C:\Users\Admin\keiol.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5bf43f2d23e44ddbd60ca4dfd41ff45b4
SHA13fb090c8158289a803f6000c44d97472884d55a5
SHA2562db0cc8fc67e57c672632e4b07c6ff48d4fe364f8fac105283431050beae8f69
SHA5124994e5a68b04375dc0d9872dba8632d8493b910054e62c638c82f5f226db643927c8d28b561ff8ad56947a65f882816f2c0abf346ed99c8ff9bc96d51065c078