Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 21:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe
-
Size
543KB
-
MD5
66b8d3e83563987ae9e6347d3dd19870
-
SHA1
576c4b768a007ff35abc4cfc14e6e0587aa309e2
-
SHA256
2197938df2d2704f6a525c27f100b7054e97d8e36588a224244cf0b652b03b96
-
SHA512
e2b285ca72bd4aa7cfc38429815c580422991130a7ad3333650e11b136571936a949fa4871640cff295a7bf2cf1192004d55492b77545c148cf702f339c5b32a
-
SSDEEP
6144:OU+xtlyDU+xtly7U+xtlyiU+xtlyDU+xtly7U+xtlyiU+xtlyDU+xtly7U+xtly3:OBUBMBNBUBMBNBUBMBNBUBMBNB
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\"" inetinfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\"" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\eksplorasi.exe\"" winlogon.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" inetinfo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" inetinfo.exe -
Disables RegEdit via registry modification 12 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" inetinfo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" inetinfo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" services.exe -
Disables cmd.exe use via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" inetinfo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0" lsass.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts-Denied By-Admin.com inetinfo.exe File opened for modification C:\Windows\System32\drivers\etc\hosts-Denied By-Admin.com inetinfo.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif smss.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif smss.exe -
Executes dropped EXE 5 IoCs
pid Process 3232 smss.exe 3288 winlogon.exe 2016 services.exe 432 lsass.exe 2852 inetinfo.exe -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\sempalong.exe\"" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\sempalong.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\sempalong.exe\"" inetinfo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\"" inetinfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\sempalong.exe\"" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\"" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\sempalong.exe\"" services.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Bron-Spizaetus = "\"C:\\Windows\\ShellNew\\sempalong.exe\"" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tok-Cirrhatus = "\"C:\\Users\\Admin\\AppData\\Local\\smss.exe\"" 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Admin's Setting.scr smss.exe File created C:\Windows\SysWOW64\Admin's Setting.scr smss.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\eksplorasi.exe 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe File created C:\Windows\ShellNew\sempalong.exe 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe File opened for modification C:\Windows\ShellNew\sempalong.exe smss.exe File opened for modification C:\Windows\eksplorasi.exe 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe File opened for modification C:\Windows\eksplorasi.exe smss.exe File opened for modification C:\Windows\ShellNew\sempalong.exe services.exe File opened for modification C:\Windows\eksplorasi.exe services.exe File opened for modification C:\Windows\eksplorasi.exe lsass.exe File opened for modification C:\Windows\ShellNew\sempalong.exe inetinfo.exe File opened for modification C:\Windows\eksplorasi.exe inetinfo.exe File opened for modification C:\Windows\ShellNew\sempalong.exe 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe File opened for modification C:\Windows\eksplorasi.exe winlogon.exe File opened for modification C:\Windows\ShellNew\sempalong.exe lsass.exe File opened for modification C:\Windows\ShellNew\sempalong.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 3232 smss.exe 3288 winlogon.exe 2016 services.exe 432 lsass.exe 2852 inetinfo.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4140 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 84 PID 5112 wrote to memory of 4140 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 84 PID 5112 wrote to memory of 4140 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 84 PID 5112 wrote to memory of 3232 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 88 PID 5112 wrote to memory of 3232 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 88 PID 5112 wrote to memory of 3232 5112 66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe 88 PID 3232 wrote to memory of 3288 3232 smss.exe 90 PID 3232 wrote to memory of 3288 3232 smss.exe 90 PID 3232 wrote to memory of 3288 3232 smss.exe 90 PID 3232 wrote to memory of 3644 3232 smss.exe 92 PID 3232 wrote to memory of 3644 3232 smss.exe 92 PID 3232 wrote to memory of 3644 3232 smss.exe 92 PID 3232 wrote to memory of 2180 3232 smss.exe 94 PID 3232 wrote to memory of 2180 3232 smss.exe 94 PID 3232 wrote to memory of 2180 3232 smss.exe 94 PID 3232 wrote to memory of 2016 3232 smss.exe 96 PID 3232 wrote to memory of 2016 3232 smss.exe 96 PID 3232 wrote to memory of 2016 3232 smss.exe 96 PID 3232 wrote to memory of 432 3232 smss.exe 98 PID 3232 wrote to memory of 432 3232 smss.exe 98 PID 3232 wrote to memory of 432 3232 smss.exe 98 PID 3232 wrote to memory of 2852 3232 smss.exe 100 PID 3232 wrote to memory of 2852 3232 smss.exe 100 PID 3232 wrote to memory of 2852 3232 smss.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\66b8d3e83563987ae9e6347d3dd19870_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:4140
-
-
C:\Users\Admin\AppData\Local\smss.exeC:\Users\Admin\AppData\Local\smss.exe2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\winlogon.exeC:\Users\Admin\AppData\Local\winlogon.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3288
-
-
C:\Windows\SysWOW64\at.exeat /delete /y3⤵PID:3644
-
-
C:\Windows\SysWOW64\at.exeat 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Brengkolang.com"3⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\services.exeC:\Users\Admin\AppData\Local\services.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Users\Admin\AppData\Local\lsass.exeC:\Users\Admin\AppData\Local\lsass.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:432
-
-
C:\Users\Admin\AppData\Local\inetinfo.exeC:\Users\Admin\AppData\Local\inetinfo.exe3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
543KB
MD566b8d3e83563987ae9e6347d3dd19870
SHA1576c4b768a007ff35abc4cfc14e6e0587aa309e2
SHA2562197938df2d2704f6a525c27f100b7054e97d8e36588a224244cf0b652b03b96
SHA512e2b285ca72bd4aa7cfc38429815c580422991130a7ad3333650e11b136571936a949fa4871640cff295a7bf2cf1192004d55492b77545c148cf702f339c5b32a