8b388fca33c514966aa2b69418974489c9652e3e38bc9d99f27e7380a452c5c2

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
Size 199KB
Sample240603-xll5jsfb4v
SHA256 8b388fca33c514966aa2b69418974489c9652e3e38bc9d99f27e7380a452c5c2
MD5 e248fef5642ec5aee2d4a93bfcf0b8f0
SHA1 9404aeb5f2fb5e744ed6ea69e0bba78c0c1ffe8b
SHA512 306bada975a672b8c7268c27a44bfb3f00bc0ba8393a1afcb3e24b9c604247cb20f1a1b8e515102302e86c60e1dc7b388f8bd63d0585a24428d557efeddf4ffb
SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmup:7vEN2U+T6i5LirrllHy4HUcMQY6z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
1200	explorer.exe
2820	spoolsv.exe
4612	svchost.exe
4924	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe
1200	explorer.exe
1200	explorer.exe
4612	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1200	explorer.exe
4612	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
1200	explorer.exe
1200	explorer.exe
2820	spoolsv.exe
2820	spoolsv.exe
4612	svchost.exe
4612	svchost.exe
4924	spoolsv.exe
4924	spoolsv.exe
1200	explorer.exe
1200	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1200	1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe	92
PID 1600 wrote to memory of 1200	1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe	92
PID 1600 wrote to memory of 1200	1600	e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe	92
PID 1200 wrote to memory of 2820	1200	explorer.exe	93
PID 1200 wrote to memory of 2820	1200	explorer.exe	93
PID 1200 wrote to memory of 2820	1200	explorer.exe	93
PID 2820 wrote to memory of 4612	2820	spoolsv.exe	94
PID 2820 wrote to memory of 4612	2820	spoolsv.exe	94
PID 2820 wrote to memory of 4612	2820	spoolsv.exe	94
PID 4612 wrote to memory of 4924	4612	svchost.exe	95
PID 4612 wrote to memory of 4924	4612	svchost.exe	95
PID 4612 wrote to memory of 4924	4612	svchost.exe	95
PID 4612 wrote to memory of 1764	4612	svchost.exe	96
PID 4612 wrote to memory of 1764	4612	svchost.exe	96
PID 4612 wrote to memory of 1764	4612	svchost.exe	96
PID 4612 wrote to memory of 1640	4612	svchost.exe	107
PID 4612 wrote to memory of 1640	4612	svchost.exe	107
PID 4612 wrote to memory of 1640	4612	svchost.exe	107
PID 4612 wrote to memory of 2836	4612	svchost.exe	109
PID 4612 wrote to memory of 2836	4612	svchost.exe	109
PID 4612 wrote to memory of 2836	4612	svchost.exe	109

C:\Users\Admin\AppData\Local\Temp\e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e248fef5642ec5aee2d4a93bfcf0b8f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1200
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1764
    - - C:\Windows\SysWOW64\at.exe
        
        at 18:59 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1640
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:00 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 216KB
SHA256 d93c26d0a890459395a3bb1dcd40359888abae141c48b1f5265de0357f5c8942
MD5 fe7daa9efb422ce69d3409da5e69a634
SHA1 5ce38adcbb33948275c2fb250f5ea5b38f1f43c7
SHA512 40f279ebf13bf7761e1cc6b813de01db84fab5eeb2e38cfb316f8ab2134b4ee8232d6d02eea6f93c9f0b96ee35e245434811269eb9241e964a5835f4cdb573d1
SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmu5:7vEN2U+T6i5LirrllHy4HUcMQY6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 216KB
SHA256 286f7d5f997ad87e47a74e22e4aa95bec714b494bc9004f2dcf6cf2eb8c962bb
MD5 6c453e84bab43df165683d88ce2dbd71
SHA1 35539b4d6f82607cae768209b365bf7abe8aa88f
SHA512 bc4647ad8ee581629009f14bbe17318bb4bce5f33272fb3f34be616d765fc0a860799087f3d78dd41c114895d034d97b83c87284bac1f5d89b614948ca2e6058
SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmuq:7vEN2U+T6i5LirrllHy4HUcMQY6M
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 216KB
SHA256 6a72a97d4c2a719b7d04cf352cc4312de462900c7a93cfaceb4c03325a65cfad
MD5 e0d6cf37ca0f7d02076e62d7e05e994d
SHA1 9c1773a16c5a38dfcc1f9304eb6669322a191686
SHA512 6b6045ee73dcb277e755f7d4d675471b44611ef6fdbdda2c682b12cac513049fee5e23b1e1a6fce8ce884d0621f87aef199651d4221bccc241283dcbdccaec87
SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4PmuQ:7vEN2U+T6i5LirrllHy4HUcMQY6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 216KB
SHA256 c372760ba198912a99b84fd0e1730f602e812f488dd0574148f4d993c1fa1e5f
MD5 47842f62d61edc533ea1cc8198c3e3c3
SHA1 c567814ac8443c3c3d2172b2e018ef5c28ac0f98
SHA512 2686042191e7a925090c89da6dee7d9c319285031839c15f60bbfa617787c01f490e90717b8801213597296d2f1a88f618c6e9cd514b249f05d65f885ff8a6f7
SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmum:7vEN2U+T6i5LirrllHy4HUcMQY6g
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1600-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1600-36-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2820-35-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4924-32-0x0000000000400000-0x0000000000431000-memory.dmp

Download