f0f3ad9f2304245eaa09cfb94aa64db68c4aa4a81730a1966c4ca60b3da8efd4

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f394dda64257d43eeb09238afbcd150_NeikiAnalytics.dll
Size

772KB
MD5

1f394dda64257d43eeb09238afbcd150
SHA1

ca23c9ccaf34cf14c7ef663d7f9c1a69eae2c83d
SHA256

f0f3ad9f2304245eaa09cfb94aa64db68c4aa4a81730a1966c4ca60b3da8efd4
SHA512

c4801ac910ae657ed724d54d698345a4167f264533f1c8dbd88ac33edc5ed70d94b820ff07a0387f20ec80f5af8da281abc32525379cde6941fb14e64c8e437f
SSDEEP

6144:bi05kH9OyU2uv5SRf/FWgFgt8gqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:urHGPv5SmpthDmUWuVZkxikdXcq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1284	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uxhwu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vz6jAA\\TpmInit.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\6894\BdeUISrv.exe	cmd.exe
File opened for modification	C:\Windows\system32\6894\BdeUISrv.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1272	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\eZ5CO.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\MSCFile\shell	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2936	rundll32.exe
2936	rundll32.exe
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found
1284	Process not Found

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2512	1284	Process not Found	28
PID 1284 wrote to memory of 2512	1284	Process not Found	28
PID 1284 wrote to memory of 2512	1284	Process not Found	28
PID 1284 wrote to memory of 2420	1284	Process not Found	29
PID 1284 wrote to memory of 2420	1284	Process not Found	29
PID 1284 wrote to memory of 2420	1284	Process not Found	29
PID 1284 wrote to memory of 2460	1284	Process not Found	31
PID 1284 wrote to memory of 2460	1284	Process not Found	31
PID 1284 wrote to memory of 2460	1284	Process not Found	31
PID 2460 wrote to memory of 2876	2460	cmd.exe	33
PID 2460 wrote to memory of 2876	2460	cmd.exe	33
PID 2460 wrote to memory of 2876	2460	cmd.exe	33
PID 1284 wrote to memory of 2904	1284	Process not Found	34
PID 1284 wrote to memory of 2904	1284	Process not Found	34
PID 1284 wrote to memory of 2904	1284	Process not Found	34
PID 1284 wrote to memory of 3012	1284	Process not Found	35
PID 1284 wrote to memory of 3012	1284	Process not Found	35
PID 1284 wrote to memory of 3012	1284	Process not Found	35
PID 1284 wrote to memory of 2844	1284	Process not Found	36
PID 1284 wrote to memory of 2844	1284	Process not Found	36
PID 1284 wrote to memory of 2844	1284	Process not Found	36
PID 1284 wrote to memory of 1012	1284	Process not Found	37
PID 1284 wrote to memory of 1012	1284	Process not Found	37
PID 1284 wrote to memory of 1012	1284	Process not Found	37
PID 1284 wrote to memory of 1304	1284	Process not Found	39
PID 1284 wrote to memory of 1304	1284	Process not Found	39
PID 1284 wrote to memory of 1304	1284	Process not Found	39
PID 1304 wrote to memory of 1888	1304	eventvwr.exe	40
PID 1304 wrote to memory of 1888	1304	eventvwr.exe	40
PID 1304 wrote to memory of 1888	1304	eventvwr.exe	40
PID 1888 wrote to memory of 1272	1888	cmd.exe	42
PID 1888 wrote to memory of 1272	1888	cmd.exe	42
PID 1888 wrote to memory of 1272	1888	cmd.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f394dda64257d43eeb09238afbcd150_NeikiAnalytics.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2936

C:\Windows\system32\TpmInit.exe
C:\Windows\system32\TpmInit.exe
1⤵
PID:2512

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\gW4jriK.cmd
1⤵
PID:2420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{f88aa085-2df5-1d76-19b1-e998b140f7f3}"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{f88aa085-2df5-1d76-19b1-e998b140f7f3}"
  2⤵
  PID:2876

C:\Windows\system32\dinotify.exe
C:\Windows\system32\dinotify.exe
1⤵
PID:2904

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe
1⤵
PID:3012

C:\Windows\system32\BdeUISrv.exe
C:\Windows\system32\BdeUISrv.exe
1⤵
PID:2844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\0T0rcs.cmd
1⤵
- Drops file in System32 directory
PID:1012

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\eZ5CO.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Trqxvscxs" /SC minute /MO 60 /TR "C:\Windows\system32\6894\BdeUISrv.exe" /RL highest
    3⤵
    - Creates scheduled task(s)
    PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0T0rcs.cmd

Filesize
195B

MD5
e06657d2c0b81646c0af2bc97c12973b

SHA1
d7bf872fc7c334cc9fc91a1295482c40017feb5f

SHA256
4584c00d43404400c3fb299dd4da895e19bf6dcd6986a7976fde1d7b507ff019

SHA512
f6e8cf4bfafe02f44ca52b7a2405f365f6211cde529142cba31c0fc0c4be3310b97be2df0b273011dd6e16ee0fc1234bb54b3da2f7142224ffe688edc53ae15d

Download Submit
C:\Users\Admin\AppData\Local\Temp\89905.tmp

Filesize
776KB

MD5
52664d93978ee44d85590631bdf1a60d

SHA1
0881ac9061ebe8f06e30501926544928430469d2

SHA256
12a4bd59b72f19962ad65c4f7b93cf059b80b991bee6f566320b82c102bc7f01

SHA512
e0bb714a4bc1f2c0800d9f309ce9af9d3eb598c188844643fba41a4b0353dae35e336e87e8d5855062ae1561b3b9ac5898f35f71ee15fd2099afa387e63eff4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\eZ5CO.cmd

Filesize
128B

MD5
cc48eb809f96c56c894f7663f7a393ea

SHA1
f5061ca77c84d9e7068899e955ac2cd0d94a1dee

SHA256
58d7c1e501d581419115ba470fe54e72238ee957e3aa099a482b78a4eee6ab02

SHA512
ca6851fd575200809866b32e53163360dcfa57e41924006f5df4419661d381b5a12bcccb6cc51e87492bd7ac6691b5ba372fe8f669c3d5e0d91795c6d0f8bff8

Download Submit
C:\Users\Admin\AppData\Local\Temp\gW4jriK.cmd

Filesize
232B

MD5
67c33fb9e9e198671a7c826a2c50fe66

SHA1
02b01fb1e1998940e9cb42327db31b643fc7a7f1

SHA256
9d0ccdcede162b56615b153017382b5e7c822aa648836a96294f173fa6d0e435

SHA512
285ff9735f9cdde931774a471c2366a3694f9adb082769152b4cc87ec9020a31a93582c0ec6b7c330aeb33e1bfc3cd5d788dff6ced81268e5f8c799910a00d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\lY9ADA.tmp

Filesize
776KB

MD5
447f1b7364312b3dba2d8b88a175e1f8

SHA1
b6e48a947e2ea337b72a82519f93b18fb97b8ba0

SHA256
b8aed07d4015017baf1bca72c2b7224e55e9fde76f8c128c42b4cc090eddee89

SHA512
c0fe6c9f041e9fd343ff2307e4b1d6e6bb5115900fbc640172c3cd6b24ddf7a69b0fd72119ca4b135dfb52d0e4a112ad0844df257af2d91b5069da36904ac8ec

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Uxhwu.lnk

Filesize
880B

MD5
eec814ec2d49e48bc214e34fc8494d92

SHA1
7fa51eaa489b39d4ca13f41adcf796c61a54f2e9

SHA256
48020dfc4035dfb5e9b2e8b79bcda2be906645d4494541c9aeb71ba129d65b57

SHA512
f9a038c463ba729d6628d381579e73696910d15eb47b636ce927bed0cd3f573e10709a8f56924c6d229056197367e45e8e13684c1ef2a133561fab38e421cfe0

Download Submit
\Users\Admin\AppData\Roaming\Vz6jAA\TpmInit.exe

Filesize
112KB

MD5
8b5eb38e08a678afa129e23129ca1e6d

SHA1
a27d30bb04f9fabdb5c92d5150661a75c5c7bc42

SHA256
4befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c

SHA512
a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d

Download Submit
memory/1284-12-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-8-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-31-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-32-0x00000000025D0000-0x00000000025D7000-memory.dmp

Filesize
28KB

Download
memory/1284-24-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-23-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-22-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-21-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-19-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-15-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-14-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-95-0x0000000077AA6000-0x0000000077AA7000-memory.dmp

Filesize
4KB

Download
memory/1284-11-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-10-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-9-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-16-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-7-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-20-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-33-0x0000000077BB1000-0x0000000077BB2000-memory.dmp

Filesize
4KB

Download
memory/1284-43-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-47-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-44-0x0000000077D10000-0x0000000077D12000-memory.dmp

Filesize
8KB

Download
memory/1284-48-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-17-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-18-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-13-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/1284-4-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1284-3-0x0000000077AA6000-0x0000000077AA7000-memory.dmp

Filesize
4KB

Download
memory/2936-2-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2936-0-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download
memory/2936-6-0x0000000140000000-0x00000001400C1000-memory.dmp

Filesize
772KB

Download