Malware Analysis Report

2025-01-06 10:59

Sample ID 240603-fjbscscb2y
Target 9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe
SHA256 440c44ba7952709e272ac7cd15315b0965b50f63b78d2c4926e3ac0e3b1da69f
Tags
evasion execution
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

440c44ba7952709e272ac7cd15315b0965b50f63b78d2c4926e3ac0e3b1da69f

Threat Level: Likely malicious

The file 9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe was found to be: Likely malicious.

Malicious Activity Summary

evasion execution

Stops running service(s)

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Launches sc.exe

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 04:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 04:53

Reported

2024-06-03 04:56

Platform

win7-20240508-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe"

Signatures

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\1230\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\Service.exe C:\Windows\SysWOW64\1230\smss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1728 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1728 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1728 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1728 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1728 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 1728 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 1728 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 1728 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2072 wrote to memory of 2296 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2072 wrote to memory of 2296 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2072 wrote to memory of 2296 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2072 wrote to memory of 2296 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe"

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

C:\Windows\SysWOW64\1230\smss.exe

C:\Windows\system32\1230\smss.exe -d

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

Network

N/A

Files

memory/1728-0-0x0000000000400000-0x000000000041F000-memory.dmp

\Windows\SysWOW64\1230\smss.exe

MD5 a7159178a2b6f6172e7cae3bb0bd4222
SHA1 2b8d9677bdf32c3cf157612738887c103668d763
SHA256 d432256de89f29966ac184b57f443862bf8ac929a6d922eb5e4acb729177f97e
SHA512 b9f58f50a38479bd72e2c7571671462169c2d1b358fe4159f95444634518327cbf85461840e476298aa7560325e2b56708aa1832eb647bbba0a4836eb5febcf6

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 04:53

Reported

2024-06-03 04:56

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe"

Signatures

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\1230\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\Service.exe C:\Windows\SysWOW64\1230\smss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9c2c4ee1406773c5faa754a81fa41030_NeikiAnalytics.exe"

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

C:\Windows\SysWOW64\1230\smss.exe

C:\Windows\system32\1230\smss.exe -d

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/4276-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\SysWOW64\1230\smss.exe

MD5 43407093632befbabdd13a812336de70
SHA1 4a97306f85f36f37f08d7d5d5de17f854d4199ea
SHA256 0755bbe8a5ed5455b6494cc9cb94cfabf646c95d88913ff2cc548d87c094c3da
SHA512 963f595a10ef041768fe8156472e2d6b6d6f7a3b7647205053a91a868e10b10b9c13e974bfbd2b4ab8dc1c8ddc839fbc1a26e7f01322d8827f39ba67620ec620