2c2f26c6095f448dff8efebba4d4ee31c12c6c8d0fc63f9de1bb6a09f53aaf99

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
Size

200KB
MD5

0d33021177166513f50715fcda6a7da0
SHA1

b459d5005d1ce67fec015a13eba1233403966651
SHA256

2c2f26c6095f448dff8efebba4d4ee31c12c6c8d0fc63f9de1bb6a09f53aaf99
SHA512

486a3b114b10732a7e10e6c9419631f98ff5e26bce0c8ec0ed7f6ff4d54b183246e926dcee231720c2fd39e32152ad7cbb6c8b03cb6507590f90c4fa179eb225
SSDEEP

3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iG:7vEN2U+T6i5LirrllHy4HUcMQY6C9iG

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
624	explorer.exe
4616	spoolsv.exe
1816	svchost.exe
844	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
1816	svchost.exe
624	explorer.exe
1816	svchost.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe
624	explorer.exe
1816	svchost.exe
1816	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
624	explorer.exe
1816	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
624	explorer.exe
624	explorer.exe
4616	spoolsv.exe
4616	spoolsv.exe
1816	svchost.exe
1816	svchost.exe
844	spoolsv.exe
844	spoolsv.exe
624	explorer.exe
624	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 624	3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe	82
PID 3128 wrote to memory of 624	3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe	82
PID 3128 wrote to memory of 624	3128	0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe	82
PID 624 wrote to memory of 4616	624	explorer.exe	83
PID 624 wrote to memory of 4616	624	explorer.exe	83
PID 624 wrote to memory of 4616	624	explorer.exe	83
PID 4616 wrote to memory of 1816	4616	spoolsv.exe	85
PID 4616 wrote to memory of 1816	4616	spoolsv.exe	85
PID 4616 wrote to memory of 1816	4616	spoolsv.exe	85
PID 1816 wrote to memory of 844	1816	svchost.exe	86
PID 1816 wrote to memory of 844	1816	svchost.exe	86
PID 1816 wrote to memory of 844	1816	svchost.exe	86
PID 1816 wrote to memory of 1316	1816	svchost.exe	87
PID 1816 wrote to memory of 1316	1816	svchost.exe	87
PID 1816 wrote to memory of 1316	1816	svchost.exe	87
PID 1816 wrote to memory of 1992	1816	svchost.exe	99
PID 1816 wrote to memory of 1992	1816	svchost.exe	99
PID 1816 wrote to memory of 1992	1816	svchost.exe	99
PID 1816 wrote to memory of 4808	1816	svchost.exe	101
PID 1816 wrote to memory of 4808	1816	svchost.exe	101
PID 1816 wrote to memory of 4808	1816	svchost.exe	101

C:\Users\Admin\AppData\Local\Temp\0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:624
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:844
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1316
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1992
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
216KB

MD5
f3269e5fe2d7d538916f9baeb85c2811

SHA1
cedbd83770cc7184c0a56ed610fa00d265950e06

SHA256
24de0dd89852741c707afe97b20074f4641eaab2f268f44c57f37bebfaafc0cd

SHA512
2db3bf543aed68e4f3e991f46502f209286625624586aa8be3d8275707d5ed5106b7e4aa383c94ee7501df3011995dc01924659726a4585e02d3abff615e91f7

Download Submit
C:\Windows\System\explorer.exe

Filesize
216KB

MD5
8c7f7255e737c8c0efaa7224906f5638

SHA1
f618225e5c627a6ec99aa038f410b5a5450ea53b

SHA256
c4dd3eea78255c2b7e4e08665a0a705370be6eb14f38111dd29bc10221c30c6f

SHA512
8f005352c3328b73ff8bb0fbc9cc5735bfb1537b05a12d05a173cf1d76cff89c33420c4b4b58b5a50364564586e35ce78e98cd2bf095b208f03ccf9a387d6881

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
216KB

MD5
98c4e2afaa6952340d8ef313fe5d9c3b

SHA1
af8161ccf77f80145bdf79a3b4c6820f8dc43bb0

SHA256
8996c96aba5c9373d08164b113eb1dfb1dab1955fc5fe58fce5e524cf2fe95b6

SHA512
e188b76ed94eba616db14c608b6a7236f3536e6074ad6a4b216faf009a82080649f17f2ff97386b64de9bed78349bc8b5bd0eef0222947d83523a576dc30971e

Download Submit
C:\Windows\System\svchost.exe

Filesize
216KB

MD5
f02d4788ea1ef467db71ab07b53aa9e1

SHA1
466d692792c6d1d41c4cb6123301cfa984af0daa

SHA256
aed6b8e93d20831c52187c191cf35da67137e7c58d33eafba721575c499a6621

SHA512
d85a191ed2ff609093867697c1e1c25a9d97588166cf77b7a3b7290a3f5461260f47614faf65cb170da47dae9c55a7766e950cad607923a28233a8f04fa56f98

Download Submit
memory/844-32-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3128-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3128-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4616-35-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download