Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 07:48

General

  • Target

    499dec953d90f081cf719664d8bdcc10_NeikiAnalytics.exe

  • Size

    135KB

  • MD5

    499dec953d90f081cf719664d8bdcc10

  • SHA1

    85289055c7ba45c22e1ad0ba97e1ef5703a55160

  • SHA256

    ebe8a31d3ff34744fcd2ec79d47b68ac130d206a9c153a1fb97755d1b08ffba9

  • SHA512

    69b1b1a3472ca43b398fbed7ac4b847ac608799e252b2aee56f7e99716806ed966f45d3d59bb529686325782e362954350dd4c4e9981f11da729a84a1888da77

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVQUVVVVVVVVVVVVp:UVqoCl/YgjxEufVU0TbTyDDalKw

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\499dec953d90f081cf719664d8bdcc10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\499dec953d90f081cf719664d8bdcc10_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:352
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1724
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2924
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2596
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2712
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:50 /f
            5⤵
            • Creates scheduled task(s)
            PID:2784
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:51 /f
            5⤵
            • Creates scheduled task(s)
            PID:1688
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:52 /f
            5⤵
            • Creates scheduled task(s)
            PID:664
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2816

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \Windows\Resources\Themes\explorer.exe

            Filesize

            135KB

            MD5

            dd56ba6ed051fe45ae4da1161e21c71b

            SHA1

            2defe0b01952f10091bbb97fcf7716467dce8cbf

            SHA256

            3f3ead8b77dfa6be320374ba40f4d153436ae0af6a3235f8da0515bdf3e1ff84

            SHA512

            bf160f1868e0c3318629268396a4f6dcb129c858e0703a8dd8ab0dd4814cbb417128cd868f61175b8ddbf30197b7c7941b21bb711b2f56810811422176b3a842

          • \Windows\Resources\spoolsv.exe

            Filesize

            135KB

            MD5

            32084c6433ee4141c9fd6100f87b684b

            SHA1

            676e0420b9170cac46a9fb00a507882c2a36c613

            SHA256

            52cce42302a584cbb495441fc765e09fd913234e9270131d06f7da6ed7e70753

            SHA512

            63be0134090266c358a748a3e5a04561265c2793735e837cbc1f695a4b24d8ab25b53f27b59aff9b0cd148112b1ea54d253c0f5bf1b0fe33d49e5bc67dec2153

          • \Windows\Resources\svchost.exe

            Filesize

            135KB

            MD5

            08c8ba5cb8d1ff660640b71e663f40b0

            SHA1

            985f705bf00268c7780023593cdfa0713c214329

            SHA256

            d6dc47f29319ed249169c2b7b33d7ccbb07b698b0d9b0c576fc5928517db7557

            SHA512

            84d4c82cfbcd0579590762476afdff1fba3aec3db04be59b8c70f6efa5e02f85e8fc5c0442a5343e3fcc7959ae98056f3c3ef06a9cd889c07580518175bdef88

          • memory/352-0-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/352-10-0x0000000000310000-0x000000000032F000-memory.dmp

            Filesize

            124KB

          • memory/352-44-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/1724-19-0x0000000000520000-0x000000000053F000-memory.dmp

            Filesize

            124KB

          • memory/2712-42-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2924-32-0x00000000002B0000-0x00000000002CF000-memory.dmp

            Filesize

            124KB

          • memory/2924-43-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB