Overview

overview

10

Static

static

3

8ea5fa30f7...cs.exe

windows7-x64

10

8ea5fa30f7...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 00:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ea5fa30f77c6539690eb8ee371c14e0_NeikiAnalytics.exe

  • Size

    620KB

  • MD5

    8ea5fa30f77c6539690eb8ee371c14e0

  • SHA1

    54b446e3dd3433381ebdee1aee6dfd27f94033af

  • SHA256

    86a83b4dfb7f4fbac3c0745f8d5d59da0d89047df459ab6a0262b9b810e8ec35

  • SHA512

    61dea8adf068ad7964562b650ab8f0540dd66a655862a601db0a81a9e931285fcff1a17d565bfa5a17b5acdd30f5d2a9757e742a8d20ea91177aeb42bdc6e3cf

  • SSDEEP

    12288:rgkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUW5:nxsKXa+hHyWseBgx5

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • UAC bypass 3 TTPs 13 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 28 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 41 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ea5fa30f77c6539690eb8ee371c14e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8ea5fa30f77c6539690eb8ee371c14e0_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Users\Admin\AppData\Local\Temp\ixujeqtrshe.exe
      "C:\Users\Admin\AppData\Local\Temp\ixujeqtrshe.exe" "c:\users\admin\appdata\local\temp\8ea5fa30f77c6539690eb8ee371c14e0_neikianalytics.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\cjlryjo.exe
        "C:\Users\Admin\AppData\Local\Temp\cjlryjo.exe" "-C:\Users\Admin\AppData\Local\Temp\brcrhbpiyhrlnhhy.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1248
      • C:\Users\Admin\AppData\Local\Temp\cjlryjo.exe
        "C:\Users\Admin\AppData\Local\Temp\cjlryjo.exe" "-C:\Users\Admin\AppData\Local\Temp\brcrhbpiyhrlnhhy.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:3040
    • C:\Users\Admin\AppData\Local\Temp\ixujeqtrshe.exe
      "C:\Users\Admin\AppData\Local\Temp\ixujeqtrshe.exe" "c:\users\admin\appdata\local\temp\8ea5fa30f77c6539690eb8ee371c14e0_neikianalytics.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    4788cde2b317856af3b86a0cd4e8da91

    SHA1

    2244731fc769472a7321f583b703938664fad3e9

    SHA256

    89edfe3220c90a5f7b510afa7ee19126ee39e0ed5979697e06ceaefc7b156091

    SHA512

    afb7221be0809e843a900f736324db79b3afdbb63cb0c7ccc37f54577777af3a51713b277965bb56e957273cb12bcac83d2cf85cef793f12d9637ff1fc7dd424

    Download Submit

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    22bb17bf5404470ae708061e8f5e7238

    SHA1

    e6cf8822ccb90249fa9fff2f4765ff3d06e21fe8

    SHA256

    3ae23513d674119e651f28b5572a4a1a6d5c375f2f99daa1fe18f0292b8eb214

    SHA512

    5bce7b4967e6fb63db1b20acb88f72aaff11b1b86c50211d618693f94bd9fa99d9e963b7e8ed9989ae7cd74bd18d5021450f5dc16883c3b745e2eac89b9dc379

    Download Submit

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    b93462584a7a24e1b92ad0460047b795

    SHA1

    6e6f0093be97053dabc3a8090186e2264a130667

    SHA256

    49396d47d31c09799aed91074935014e89f9e61ebb4527dc2256764aaa503fb8

    SHA512

    d7868f98d116eed549d022739f3c9127f89796714eca07e36fcb5f5327fe84474369430140cb379177b87eb11bd8c4a6960ee5562bd245b82abc27cbfada9a50

    Download Submit

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    f261ad175a19a8be4e5abd626ab38e97

    SHA1

    ce05650468cc35c38890b8afd190c71538a4d8dd

    SHA256

    3a6a30379ab9b006f1b9ba2e2d9ed1d96db3d96b359f8256c49cf41210bcbd0b

    SHA512

    6b363963bfd4a62967df6111ec1894e0a216ad81217cb07272891b4cd0b15fe3bb4c54835710d6c3dcd40b673f2b8953b5a68d45ac0d062068f87bd519c74595

    Download Submit

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    7b35f3a8d7fd8f9ddc3dfd2a871cffc2

    SHA1

    6d3212aabe1f7cbd928582129f11e4820bc6600c

    SHA256

    d2dda312986511549e5f5d4380b173e07ecdddaaacde5318a8dc67b6ae4af20f

    SHA512

    8e75f4e27d3d1d8bde13d65fa389f48591ccd3441495e6f721ddaa80e5f65de852fba4891ea2e1d329c9c55608eed3a740b47795436f775effc0168a5519c100

    Download Submit

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    15614f52410cec2764b9dcd9bf70903e

    SHA1

    8fcaa630f91e1b2aff5acc20319190c81acca530

    SHA256

    ff371511b80d371376af8aea81be3f807d70919ad367921bf4b8570f8f97e5c4

    SHA512

    724548c0964b68020c181ef4e17cfc5592560abebe5cd3b6ebcf736d221ef2ec5ea6b00e3873ee8a37cb1a76009c22c817a908fdf46dbc98cec95082272e76d0

    Download Submit

  • C:\Program Files (x86)\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    b6fd3d63e591661a0a6e68f294845a3e

    SHA1

    74856b4fe6bc658477ea71f62c4d605779131e8c

    SHA256

    0987a4fa3143b09573ddde81e78c9aed58937d70a8e3023fd1de846c88ce70a7

    SHA512

    ec970132dd9bd59cdedc1ce1824ba67a1fd60ec2fdd5f7f51663a80abc9c6ff19a71954580111865a294689988bbf5b94ba35e5876221a891e80510b58da4c1f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cjlryjo.exe
    Filesize

    724KB

    MD5

    6b8c1ecf62bb3375f756c40ad43acf12

    SHA1

    6c3c17e6fb54cfc84180e7b5f1956c381001cbb5

    SHA256

    a9654bffabdb74f7459b4058a31eae91f66439caa98b83cbf8fbffc0c7ca2089

    SHA512

    d0c65bc377519e8b5e1f3c028a754cab6f463420df28f2a61298c8a964459fd2b074a17f49855fe3eb5a1617dd9a7eedef747b3f0e82d7e6ca0cc2f662b2a0ef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ixujeqtrshe.exe
    Filesize

    320KB

    MD5

    1dd5dd5561723f37ccc81e15ecdbf830

    SHA1

    eeb9131c8d276ceb710d163e89fdc62b3e111971

    SHA256

    c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126

    SHA512

    b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5

    Download Submit

  • C:\Users\Admin\AppData\Local\blqzjxfscfjxthbmolzjoxhvdqadhvrf.kmj
    Filesize

    3KB

    MD5

    65a24105a3371904f9f3710e8e341e1d

    SHA1

    b64fcd37ae0696976d946c33164278ae55245338

    SHA256

    a2f10ca402388f2b852c769a62db56f968c4d02157ec45079065baaf165373ff

    SHA512

    468bc48ac9a09fdadff08f4ba9322bda3199b1510324badf20373cd3fa47f101c2670456189c8d957a02f77c1a16b918da75e09a9f7234f628754426fabc1529

    Download Submit

  • C:\Users\Admin\AppData\Local\gfzxwzwyxpilwziizlonh.ehe
    Filesize

    272B

    MD5

    b7324471fd9e34a4a8bdf402ef5b2a46

    SHA1

    52b1862873fa78f6c36b64b46ec6bccfc84218b5

    SHA256

    10b7d1389287754f80913882e5be906c3a11add7fdecc646878bae4fb15caaac

    SHA512

    f19d57919a94bbc57ea53f2a5b84aff5c17cfcc459a640bad83a75b1a0f8d86cf5333e917301881cc95b36a5ac158ba80a70ce76120750d82959e2e1cba13667

    Download Submit

  • C:\Windows\SysWOW64\rjwnfbrmepbxbxzsch.exe
    Filesize

    620KB

    MD5

    8ea5fa30f77c6539690eb8ee371c14e0

    SHA1

    54b446e3dd3433381ebdee1aee6dfd27f94033af

    SHA256

    86a83b4dfb7f4fbac3c0745f8d5d59da0d89047df459ab6a0262b9b810e8ec35

    SHA512

    61dea8adf068ad7964562b650ab8f0540dd66a655862a601db0a81a9e931285fcff1a17d565bfa5a17b5acdd30f5d2a9757e742a8d20ea91177aeb42bdc6e3cf

    Download Submit

  • C:\irvdmzgsb.bat
    Filesize

    656KB

    MD5

    a9a96205cc78f0ecb7cdbe22a51f7d54

    SHA1

    e6620b8066a28771447a2cc71de59ebcf1da2a39

    SHA256

    795ed49a1f46f18237931bf8cf77cb2c89ef237bb6139f32295538adc3e9b780

    SHA512

    7db47330990976cd39a5ca681b4fa26302cfe86774b543948548b2dcb16b2d5449070bc8d92a297537dd798292fbe98d575be91443d2fa9638a8f68e325c1114

    Download Submit