cad48043676b26ad3d48b93e195744694a7199d8344058268a54c9cdc1a09341

General

Target

493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe
Size

244KB
MD5

493f5c6079a421095b1a8921edf7b5c0
SHA1

8bc4f79f254f56265333bb2cf298feecf312e5ea
SHA256

cad48043676b26ad3d48b93e195744694a7199d8344058268a54c9cdc1a09341
SHA512

aa38ebea5e53c0c71d9f28726057c3cd1ef07fcee74bad1285e38f0cc25c3354879aa9f56914559b76886ecd5e540801a56275e2d4fafd81a9d5f237ad2e1d88
SSDEEP

6144:SEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5EmX:3Aylvv5YRwh9HYd61xhmX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3060	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe
2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe
2724	WerFault.exe
2724	WerFault.exe
2724	WerFault.exe
2724	WerFault.exe
2724	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\7a614b12 = "C:\\Windows\\apppatch\\svchost.exe"	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\7a614b12 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	3060	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3060	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3060	2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe	28
PID 2964 wrote to memory of 3060	2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe	28
PID 2964 wrote to memory of 3060	2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe	28
PID 2964 wrote to memory of 3060	2964	493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe	28
PID 3060 wrote to memory of 2724	3060	svchost.exe	29
PID 3060 wrote to memory of 2724	3060	svchost.exe	29
PID 3060 wrote to memory of 2724	3060	svchost.exe	29
PID 3060 wrote to memory of 2724	3060	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\493f5c6079a421095b1a8921edf7b5c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 356
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\AppPatch\svchost.exe

Filesize
244KB

MD5
df7bb5865362dde8358518d82cab2328

SHA1
7f36f5635ea985d68b5ab7916a6a992103222193

SHA256
75abbb7b89511b72797cdb682db41c07233148ba84191e7f083125209cbb4153

SHA512
7d2af0991a660d98f5d8be8c250a6d3c5b83e8f72334684021c47974143a56407fe1017c715c052338f593adf727265c39c6c0cce6bed34b714b81f7962161d3

Download Submit
memory/2964-18-0x0000000000290000-0x00000000002F8000-memory.dmp

Filesize
416KB

Download
memory/2964-1-0x0000000000290000-0x00000000002F8000-memory.dmp

Filesize
416KB

Download
memory/2964-3-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2964-19-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2964-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3060-21-0x0000000000370000-0x00000000003BA000-memory.dmp

Filesize
296KB

Download
memory/3060-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3060-17-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3060-27-0x0000000000370000-0x00000000003BA000-memory.dmp

Filesize
296KB

Download
memory/3060-30-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3060-25-0x0000000000370000-0x00000000003BA000-memory.dmp

Filesize
296KB

Download
memory/3060-23-0x0000000000370000-0x00000000003BA000-memory.dmp

Filesize
296KB

Download
memory/3060-29-0x0000000000370000-0x00000000003BA000-memory.dmp

Filesize
296KB

Download
memory/3060-31-0x0000000001E20000-0x0000000001E78000-memory.dmp

Filesize
352KB

Download
memory/3060-33-0x0000000001E20000-0x0000000001E78000-memory.dmp

Filesize
352KB

Download
memory/3060-35-0x0000000001E20000-0x0000000001E78000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads