Analysis
- max time kernel
142s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 11:37
General
- Target a20f62a01ac50c66d9854ea103ca1760_NeikiAnalytics.exe
- Size 212KB
- Sample240603-nrfehsed48
- SHA256 f474aa9edd5f17e7a9ace0abe05102338daf00ccf37c1d1f7e465555537b3347
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20f62a01ac50c66d9854ea103ca1760_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a20f62a01ac50c66d9854ea103ca1760_NeikiAnalytics.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
login[2].htm
login[1].htm
1FC.tmp
1FC.tmp
544A.tmp
5AB5.tmp
621C.tmp
621C.tmp
svchost.exe
memory/2604-0-0x0000000000400000-0x00000000005BA000-memory.dmp
memory/2604-11-0x0000000000400000-0x00000000005BA000-memory.dmp
memory/2604-15-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2604-14-0x0000000002360000-0x00000000023B1000-memory.dmp
memory/2604-2-0x0000000000400000-0x000000000045F000-memory.dmp
memory/2604-1-0x0000000002360000-0x00000000023B1000-memory.dmp
memory/3120-58-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-49-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-30-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-34-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-71-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-80-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-79-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-78-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-77-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-76-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-75-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-74-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-73-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-72-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-70-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-69-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-65-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-64-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-63-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-62-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-61-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-60-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-59-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-22-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-57-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-56-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-55-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-54-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-52-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-51-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-50-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-24-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-48-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-47-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-46-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-45-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-44-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-43-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-41-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-39-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-38-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-37-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-67-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-35-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-33-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-32-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-31-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-28-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-29-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-27-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-26-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-53-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-42-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-40-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-36-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-20-0x0000000002D00000-0x0000000002DB6000-memory.dmp
memory/3120-19-0x0000000000400000-0x00000000005BA000-memory.dmp
memory/3120-18-0x0000000002B10000-0x0000000002BB8000-memory.dmp
memory/3120-17-0x0000000000400000-0x00000000005BA000-memory.dmp
memory/3120-16-0x0000000000400000-0x00000000005BA000-memory.dmp
memory/3120-13-0x0000000000400000-0x00000000005BA000-memory.dmp
memory/3120-25-0x0000000002D00000-0x0000000002DB6000-memory.dmp