b34ef1aeed03e2cf0ec4b61d6906c2efa890d1c306094959bb43cf51ed2ae935

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1ea64a35150d3b801385aa1420e0c0_NeikiAnalytics.dll
Size

484KB
MD5

3a1ea64a35150d3b801385aa1420e0c0
SHA1

ab832ada796e2a83a8e1331bc59a0ae75b195d89
SHA256

b34ef1aeed03e2cf0ec4b61d6906c2efa890d1c306094959bb43cf51ed2ae935
SHA512

8407d84d402151055d96d45c2d6286274b4d55e3313063def90ea3edf612c1ce8b5ddf422ef1885f3dbbd8034955e606e2447977c1edff647c933d02b76a9660
SSDEEP

6144:ti05kH9OyU2uv5SRf/FWgFgtbgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:YrHGPv5SmptsDmUWuVZkxikdXcq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1204	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yyeybzteybdsbj = "\"C:\\Users\\Admin\\AppData\\Roaming\\FD7NR9m\\BitLockerWizardElev.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\2821\wextract.exe	cmd.exe
File opened for modification	C:\Windows\system32\2821\wextract.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2472	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell\open	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\oTP.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\MSCFile\shell\open\command	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	rundll32.exe
2344	rundll32.exe
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1100	1204	Process not Found	28
PID 1204 wrote to memory of 1100	1204	Process not Found	28
PID 1204 wrote to memory of 1100	1204	Process not Found	28
PID 1204 wrote to memory of 2740	1204	Process not Found	29
PID 1204 wrote to memory of 2740	1204	Process not Found	29
PID 1204 wrote to memory of 2740	1204	Process not Found	29
PID 1204 wrote to memory of 2592	1204	Process not Found	30
PID 1204 wrote to memory of 2592	1204	Process not Found	30
PID 1204 wrote to memory of 2592	1204	Process not Found	30
PID 1204 wrote to memory of 2468	1204	Process not Found	31
PID 1204 wrote to memory of 2468	1204	Process not Found	31
PID 1204 wrote to memory of 2468	1204	Process not Found	31
PID 1204 wrote to memory of 2456	1204	Process not Found	32
PID 1204 wrote to memory of 2456	1204	Process not Found	32
PID 1204 wrote to memory of 2456	1204	Process not Found	32
PID 1204 wrote to memory of 2464	1204	Process not Found	34
PID 1204 wrote to memory of 2464	1204	Process not Found	34
PID 1204 wrote to memory of 2464	1204	Process not Found	34
PID 2464 wrote to memory of 2980	2464	cmd.exe	36
PID 2464 wrote to memory of 2980	2464	cmd.exe	36
PID 2464 wrote to memory of 2980	2464	cmd.exe	36
PID 1204 wrote to memory of 1516	1204	Process not Found	37
PID 1204 wrote to memory of 1516	1204	Process not Found	37
PID 1204 wrote to memory of 1516	1204	Process not Found	37
PID 1204 wrote to memory of 2188	1204	Process not Found	38
PID 1204 wrote to memory of 2188	1204	Process not Found	38
PID 1204 wrote to memory of 2188	1204	Process not Found	38
PID 1204 wrote to memory of 2520	1204	Process not Found	39
PID 1204 wrote to memory of 2520	1204	Process not Found	39
PID 1204 wrote to memory of 2520	1204	Process not Found	39
PID 1204 wrote to memory of 2796	1204	Process not Found	40
PID 1204 wrote to memory of 2796	1204	Process not Found	40
PID 1204 wrote to memory of 2796	1204	Process not Found	40
PID 1204 wrote to memory of 2812	1204	Process not Found	41
PID 1204 wrote to memory of 2812	1204	Process not Found	41
PID 1204 wrote to memory of 2812	1204	Process not Found	41
PID 1204 wrote to memory of 2828	1204	Process not Found	42
PID 1204 wrote to memory of 2828	1204	Process not Found	42
PID 1204 wrote to memory of 2828	1204	Process not Found	42
PID 1204 wrote to memory of 2948	1204	Process not Found	43
PID 1204 wrote to memory of 2948	1204	Process not Found	43
PID 1204 wrote to memory of 2948	1204	Process not Found	43
PID 1204 wrote to memory of 3028	1204	Process not Found	45
PID 1204 wrote to memory of 3028	1204	Process not Found	45
PID 1204 wrote to memory of 3028	1204	Process not Found	45
PID 3028 wrote to memory of 2660	3028	eventvwr.exe	46
PID 3028 wrote to memory of 2660	3028	eventvwr.exe	46
PID 3028 wrote to memory of 2660	3028	eventvwr.exe	46
PID 2660 wrote to memory of 2472	2660	cmd.exe	48
PID 2660 wrote to memory of 2472	2660	cmd.exe	48
PID 2660 wrote to memory of 2472	2660	cmd.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1ea64a35150d3b801385aa1420e0c0_NeikiAnalytics.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344

C:\Windows\system32\sdchange.exe
C:\Windows\system32\sdchange.exe
1⤵
PID:1100

C:\Windows\system32\sdiagnhost.exe
C:\Windows\system32\sdiagnhost.exe
1⤵
PID:2740

C:\Windows\system32\PresentationHost.exe
C:\Windows\system32\PresentationHost.exe
1⤵
PID:2592

C:\Windows\system32\BitLockerWizardElev.exe
C:\Windows\system32\BitLockerWizardElev.exe
1⤵
PID:2468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\BBurCu.cmd
1⤵
PID:2456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{2262e400-a0a9-2d5f-1946-aa1a0d59cbbd}"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{2262e400-a0a9-2d5f-1946-aa1a0d59cbbd}"
  2⤵
  PID:2980

C:\Windows\system32\printfilterpipelinesvc.exe
C:\Windows\system32\printfilterpipelinesvc.exe
1⤵
PID:1516

C:\Windows\system32\TSTheme.exe
C:\Windows\system32\TSTheme.exe
1⤵
PID:2188

C:\Windows\system32\wiaacmgr.exe
C:\Windows\system32\wiaacmgr.exe
1⤵
PID:2520

C:\Windows\system32\TSTheme.exe
C:\Windows\system32\TSTheme.exe
1⤵
PID:2796

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:2812

C:\Windows\system32\wextract.exe
C:\Windows\system32\wextract.exe
1⤵
PID:2828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Lf5xmx.cmd
1⤵
- Drops file in System32 directory
PID:2948

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\oTP.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Kzcfjezwvyzrv" /SC minute /MO 60 /TR "C:\Windows\system32\2821\wextract.exe" /RL highest
    3⤵
    - Creates scheduled task(s)
    PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BBurCu.cmd

Filesize
245B

MD5
be53ebaa79bfed0c56301c212f67b15c

SHA1
f72e1bfc4e4c411bfbb29380876f6caef46beef9

SHA256
4afb8b5e44599b6968ecde6a21decf168c264586e8fe22a6c250ea715ae996b7

SHA512
0d5e6eb4a6a993c172b2e1b806d226c021c3f9513a5ffe9b601dc3e3759f57bcea11cca781395337a45df18589c5e0557ace98151f7fa74c856d74b914f98a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lf5xmx.cmd

Filesize
195B

MD5
aafdd9408a71d549963d769bc87ae79f

SHA1
f1d16d01559a758e8f63128f42efe17eb35cc3e2

SHA256
77e5ca51a16e123ee7ba1a5c5a0d291044fc4a6c91a9547522538bf42bdef7b8

SHA512
bc6767e23d59fd97741d2361655c92923d1ca2ddb3a9553395b3e8126fa2812984589f30cd8c322b563b8628b20e6edb5c1ba5105ce59dc785378072684f89d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\OX43286.tmp

Filesize
488KB

MD5
30d707b291bb306e223494e392aa6103

SHA1
cf18bcf84853c0e9c76023b3bdd9cf5bfb9b11b0

SHA256
7693d09aaa3f21f08312f720628ac13bad1bc41c91b96d6a36a052b80027466a

SHA512
2cac66afad43448470ab53381c13d612a9e6c3756051ab1149c4afd9b6d0d2a5a6cb51873b67f4dfec5c1808efdf47c0d970d14d638e89e51e151cabb5d6225f

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3025.tmp

Filesize
488KB

MD5
99cec81d0ccf3c681b58ab967f13815c

SHA1
7b6ddc74087630f16c2f1689afb20da7fd37da22

SHA256
032ad6e6e14643c4b89919e1f827ae1830e1aaced5f0492242a3b59f03f30726

SHA512
0cfed8d45208522d8bf10455e8149ebfca1c4bbfe8918ba0332767c71556d847be87a64e0b63c639c3bfb4c628b9818d47248d1562d8c13929bf3fce8e8f9b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\oTP.cmd

Filesize
132B

MD5
04c345eec506fa02033acfb7f6a9a30d

SHA1
4ad6314f35d070d5551a42ad33bea96ec41b830a

SHA256
fd1748d48579390654c07c3665554eded21691f4b762de7373616a4461ebbb0a

SHA512
26e82ce301ff4ff59510908977e9cbfbb0eceeace4fccf7b7620bbc8eba216f08cc10be9a5e60ea9b056cff7d12747b7c69b4dba073b965a19e8227f8bfd3d81

Download Submit
C:\Users\Admin\AppData\Roaming\FD7NR9m\BitLockerWizardElev.exe

Filesize
98KB

MD5
73f13d791e36d3486743244f16875239

SHA1
ed5ec55dbc6b3bda505f0a4c699c257c90c02020

SHA256
2483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8

SHA512
911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yyeybzteybdsbj.lnk

Filesize
948B

MD5
10392731c3dacd7cd84b4de004a1ff85

SHA1
7893452a523b7245311634db84f161417c61b647

SHA256
a7b1558c42cd62841a15d5aed22d94182d1fbe71ee76b985747dd48cbdde89ba

SHA512
b182142e1de79edb409765d68c3b726aaebe1529a1b9005f752cabf7b14065734ce29ba35c826a90f3f8812d25de13497c891e4cbd496df7def6918f66ca0514

Download Submit
memory/1204-16-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-11-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-31-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-24-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-23-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-22-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-21-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-20-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-19-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-18-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-17-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-95-0x0000000077A06000-0x0000000077A07000-memory.dmp

Filesize
4KB

Download
memory/1204-15-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-35-0x0000000077C11000-0x0000000077C12000-memory.dmp

Filesize
4KB

Download
memory/1204-12-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-32-0x0000000002E00000-0x0000000002E07000-memory.dmp

Filesize
28KB

Download
memory/1204-10-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-9-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-8-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-42-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-44-0x0000000077D70000-0x0000000077D72000-memory.dmp

Filesize
8KB

Download
memory/1204-47-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-48-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-49-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-14-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-13-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-7-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/1204-3-0x0000000077A06000-0x0000000077A07000-memory.dmp

Filesize
4KB

Download
memory/1204-4-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/2344-6-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download
memory/2344-2-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2344-0-0x0000000140000000-0x0000000140079000-memory.dmp

Filesize
484KB

Download