Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 01:02

General

  • Target

    1880a56c2c4c6b49744019f909c24090_NeikiAnalytics.exe

  • Size

    71KB

  • MD5

    1880a56c2c4c6b49744019f909c24090

  • SHA1

    301682d45a7253697d0522830a7c24bdd1c07973

  • SHA256

    210928547fea895545d44f56da985c6257c30fd5f520aee3a86cd15e31ab1885

  • SHA512

    4f86f08058195f6b08c7b5a99bb58170e2586ce8c778726f7d0b820c15315152445009480f6378379e3e94aa497f97941ff2ca2eaba7028c35303d963454e33b

  • SSDEEP

    768:EXKeT2Si83nLt8tkGX8uxOHgRrW5YLKG9Y/HrSNm0kmG7xMsVAnc3yy85SBiLFMv:EFrmh0HgB3LKrL9AcnQFMc9zwR6i+BO

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1880a56c2c4c6b49744019f909c24090_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1880a56c2c4c6b49744019f909c24090_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2492
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2052
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2516
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2700
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2524
          • C:\Windows\SysWOW64\at.exe
            at 01:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:636
            • C:\Windows\SysWOW64\at.exe
              at 01:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1920
              • C:\Windows\SysWOW64\at.exe
                at 01:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2936

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                71KB

                MD5

                9a1f3f21c882ffc14b745d882f721f42

                SHA1

                d9d60d0a208ddd28057847cad2f3d8f1f9329a48

                SHA256

                36ac345fc2bc825d6f0981bd0132eedc769302c75590079a1eb1fd7aad259e32

                SHA512

                c3a35fe6189422462b61071faa2c14c7db989d1ac0038d69880d3a010e5071d0c6cf3e3818bb7abf80cd36f611a88bc6f8b57f5f00ff52015a8d1e6cf19bd48d

              • \Windows\system\explorer.exe

                Filesize

                71KB

                MD5

                5fb710527268e27becd8f88f87cefcef

                SHA1

                8447f4f1ae94306167949c1ec768cb16b56c8a41

                SHA256

                82ba18c94e5b830328d5cf54fdad9cd6851dabdf779f337cfbcec5082be68d4d

                SHA512

                ba01828bd5fb79eb19f29ef3b3fd44e7c0283f2cdb2d70185a7808e840597910cecd56018d6844f87a55742e7f2e00e1c7dc59fbf4abf9249332e8f76a06842e

              • \Windows\system\spoolsv.exe

                Filesize

                71KB

                MD5

                d43737eb1eca03c1f7c5e80f87bd6fce

                SHA1

                6b5c82d588cfac11442a82edde1f75a84f5c1076

                SHA256

                57aa8c62fdb195dcbb56f38bfd455fb269958442881750bbf6e0db9564538b7b

                SHA512

                0dfc8ff5024c2636a4229d6f79132741803fb3976012b31023355575315f81d51f6bf1fa2ed2ad2871d5ef59006cfb86d46e09fb164ee3499ec40c922ce1d559

              • \Windows\system\svchost.exe

                Filesize

                71KB

                MD5

                1def0049029a2a5371d98c71af82032f

                SHA1

                25e3c00a2b8bb2071fe40b339626b3d8e6fc580e

                SHA256

                59a084fb50b3fc175e41abf64619e49d73fcc2dd8fb1aa2faaadfc52eb616efc

                SHA512

                a4c8abccd6552efff0d73918f043c41bfe9546ed815d7d3955123558057a6fb22a79968095251ed5a109d4038bbcec78ccdcccfda6f65d201d3e606e95c48846

              • memory/2052-15-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2052-77-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2052-65-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2052-29-0x0000000002A50000-0x0000000002A85000-memory.dmp

                Filesize

                212KB

              • memory/2492-8-0x0000000002570000-0x00000000025A5000-memory.dmp

                Filesize

                212KB

              • memory/2492-62-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2492-0-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2492-14-0x0000000002570000-0x00000000025A5000-memory.dmp

                Filesize

                212KB

              • memory/2516-45-0x0000000002610000-0x0000000002645000-memory.dmp

                Filesize

                212KB

              • memory/2516-63-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2524-53-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2524-57-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2700-51-0x0000000000580000-0x00000000005B5000-memory.dmp

                Filesize

                212KB

              • memory/2700-46-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2700-66-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/2700-69-0x0000000000580000-0x00000000005B5000-memory.dmp

                Filesize

                212KB

              • memory/2700-70-0x0000000000580000-0x00000000005B5000-memory.dmp

                Filesize

                212KB