Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/06/2024, 18:05
General
- Target 83b4adbb55e61c0aa251421d7f6462a0_NeikiAnalytics.dll
- Size 756KB
- Sample240603-wph2maec7z
- SHA256 9429e976d4a5894cfec519c294e3adbdaa64c68fc9c609261e78f0c11cbe6019
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83b4adbb55e61c0aa251421d7f6462a0_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\immersivetpmvscmgrsvr.exeC:\Windows\system32\immersivetpmvscmgrsvr.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\gIi.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6fbc9e50-6a1b-17d9-5db5-133f618c672e}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6fbc9e50-6a1b-17d9-5db5-133f618c672e}"2⤵
-
-
C:\Windows\system32\GameBarPresenceWriter.exeC:\Windows\system32\GameBarPresenceWriter.exe1⤵
-
C:\Windows\system32\MdRes.exeC:\Windows\system32\MdRes.exe1⤵
-
C:\Windows\system32\EduPrintProv.exeC:\Windows\system32\EduPrintProv.exe1⤵
-
C:\Windows\system32\backgroundTaskHost.exeC:\Windows\system32\backgroundTaskHost.exe1⤵
-
C:\Windows\system32\AxInstUI.exeC:\Windows\system32\AxInstUI.exe1⤵
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bRhQD.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\5BbpYG.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Lgeeulo" /SC minute /MO 60 /TR "C:\Windows\system32\9789\dpapimig.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
0V5F8D7.tmp
1FA20.tmp
5BbpYG.cmd
bRhQD.cmd
gIi.cmd
Esxju.lnk
immersivetpmvscmgrsvr.exe
memory/3520-39-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-21-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-44-0x00007FFCC6BE0000-0x00007FFCC6BF0000-memory.dmp
memory/3520-43-0x00000000006C0000-0x00000000006C7000-memory.dmp
memory/3520-51-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-8-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-7-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-16-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-6-0x00007FFCC4FCA000-0x00007FFCC4FCB000-memory.dmp
memory/3520-23-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-3-0x0000000002460000-0x0000000002461000-memory.dmp
memory/3520-30-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-22-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-9-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-20-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-19-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-18-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-17-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-15-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-14-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-13-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-12-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-11-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/3520-10-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/4388-0-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/4388-5-0x0000000140000000-0x00000001400BD000-memory.dmp
memory/4388-2-0x0000027CCE740000-0x0000027CCE747000-memory.dmp