Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:30
Behavioral task
behavioral1
Sample
a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe
- Size 225KB
- Sample240603-mkap1sbd3v
- SHA256 746ed03446b60ee087aa32b9fd4ddfad700a4d21d7294bcac5b9f09aedec7a39
- MD5 a02cd56dae9779ae9d06639f14464510
- SHA1 0999cc137fc3ea701e8896cfac598aa3ccaf6da3
- SHA512 0605f6a34accdca4591bfac74bb10a04d8cf1e794e0e95042184df183a572796e0f4309fbe9af8ce8ab7e5827c54006ff242d63e1a9d9c7f5869bafc084b88fc
- SSDEEP 3072:8vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u8vMSRL:8vEN2U+T6i5LirrllHy4HUcMQY6vMSh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 3384 explorer.exe 3064 spoolsv.exe 3500 svchost.exe 1532 spoolsv.exe -
resource yara_rule behavioral2/memory/4856-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000a000000023440-7.dat upx behavioral2/files/0x0008000000023453-13.dat upx behavioral2/files/0x0008000000023455-23.dat upx behavioral2/memory/3500-25-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1532-35-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4856-37-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0009000000023454-38.dat upx behavioral2/memory/3064-36-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3384-39-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3500-40-0x0000000000400000-0x0000000000435000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3384 explorer.exe 3500 svchost.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3500 svchost.exe 3500 svchost.exe 3384 explorer.exe 3384 explorer.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3384 explorer.exe 3500 svchost.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3500 svchost.exe 3384 explorer.exe 3500 svchost.exe 3384 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3384 explorer.exe 3500 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 3384 explorer.exe 3384 explorer.exe 3064 spoolsv.exe 3064 spoolsv.exe 3500 svchost.exe 3500 svchost.exe 1532 spoolsv.exe 1532 spoolsv.exe 3384 explorer.exe 3384 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3384 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 82 PID 4856 wrote to memory of 3384 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 82 PID 4856 wrote to memory of 3384 4856 a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe 82 PID 3384 wrote to memory of 3064 3384 explorer.exe 83 PID 3384 wrote to memory of 3064 3384 explorer.exe 83 PID 3384 wrote to memory of 3064 3384 explorer.exe 83 PID 3064 wrote to memory of 3500 3064 spoolsv.exe 84 PID 3064 wrote to memory of 3500 3064 spoolsv.exe 84 PID 3064 wrote to memory of 3500 3064 spoolsv.exe 84 PID 3500 wrote to memory of 1532 3500 svchost.exe 85 PID 3500 wrote to memory of 1532 3500 svchost.exe 85 PID 3500 wrote to memory of 1532 3500 svchost.exe 85 PID 3500 wrote to memory of 4624 3500 svchost.exe 87 PID 3500 wrote to memory of 4624 3500 svchost.exe 87 PID 3500 wrote to memory of 4624 3500 svchost.exe 87 PID 3500 wrote to memory of 408 3500 svchost.exe 99 PID 3500 wrote to memory of 408 3500 svchost.exe 99 PID 3500 wrote to memory of 408 3500 svchost.exe 99 PID 3500 wrote to memory of 3788 3500 svchost.exe 101 PID 3500 wrote to memory of 3788 3500 svchost.exe 101 PID 3500 wrote to memory of 3788 3500 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a02cd56dae9779ae9d06639f14464510_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Windows\SysWOW64\at.exeat 10:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4624
-
-
C:\Windows\SysWOW64\at.exeat 10:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:408
-
-
C:\Windows\SysWOW64\at.exeat 10:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3788
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 225KB
- SHA256 c7266dd9b7d87fa1eaa40053532be8c750c8d095753d463064bea498d6d8bf4c
- MD5 6191ae90a6810d292335a9e61ac4c3ed
- SHA1 326aee341ea4c7d0d31448037361a66713e1585e
- SHA512 a25f2e760571c0ac69e7cc57a5e4849a011b075f252ead8a4da5738d2ddb1dcdba1647017519ec46166881f86e92993dc3b4e92fc6cf1ba0fe0a6ed72563aff6
- SSDEEP 3072:8vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u8vMSRW:8vEN2U+T6i5LirrllHy4HUcMQY6vMSE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 225KB
- SHA256 1a7786c9ffca956080b2fd14b7bce8f739128aaf2e659fbea6b44d0ff0698723
- MD5 42077e0de2216824a137119bf82b7cf2
- SHA1 db2833dc4b3e18ee837c1c276312f8872abf2eff
- SHA512 b01ee1d39207609e73e221a9f5b0ae3ffa8b2dc263670f9ed54df7dbf827408c4ec35abd8dc12996009e9576c93d8ea62ae4a9a6dc70f671d36ec1872b3850c8
- SSDEEP 3072:8vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u8vMSRX:8vEN2U+T6i5LirrllHy4HUcMQY6vMSp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 225KB
- SHA256 c11393948f809886c112ccc4b5ff8cd5e546c381c8c80d2607e999392aa625fc
- MD5 083ce5d0fc5f917c14156fdac6858da8
- SHA1 a6cd66623a3ce38739430f47da39ff8b627ef599
- SHA512 d9b1c5cacdcab414a8cf1f6784f6109fd704692f07f8cdf614613ae87fd7b89fd3bc4532f2f1dae0e6648187068e35a05d55214bc3aa4d6bc420e501bcbdaf68
- SSDEEP 3072:8vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u8vMSRO:8vEN2U+T6i5LirrllHy4HUcMQY6vMSA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 225KB
- SHA256 1612bcad8ed149e272b8e59f348ea72a3c76add01f51202afbc8690e1df20c24
- MD5 8220ee3b9ffc59c9483f341ef058c3d1
- SHA1 28fa1bd3ad52378a90200aea3f3a778969addee5
- SHA512 dae0b1ba49a41e429e6249978a11d408a51c7a3a19eb40670671b9101a3411570350b1d486d789e8afbd7b5ac4c5c305b4f70708cf37160591165445e7d260ff
- SSDEEP 6144:8vEN2U+T6i5LirrllHy4HUcMQY6vMS6TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTs:OENN+T5xYrllrU7QY6cTTTTTTTTTTTTM
- MD5 SHA1 SHA512 SSDEEP