Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe
-
Size
135KB
-
MD5
49caa5edfc4e78f44f545d175ba9b5b0
-
SHA1
ee61df54a4095b0b8c44541ce2409db8e69be51f
-
SHA256
2d69a5b80c686a8297c15671404a80e39fe9c5d056d0a4e4cd717dbbb105c1c2
-
SHA512
0b49b84199800d15eac0baeb754e91e01faaa27157843608555d8b7034159486052c658807217571a1e376631a281020e7d821511a47aefe99b0caa1a0fda34e
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVgt:UVqoCl/YgjxEufVU0TbTyDDalit
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 1636 explorer.exe 1580 spoolsv.exe 2576 svchost.exe 2644 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 1636 explorer.exe 1580 spoolsv.exe 2576 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2468 schtasks.exe 1524 schtasks.exe 1616 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 2576 svchost.exe 1636 explorer.exe 1636 explorer.exe 1636 explorer.exe 2576 svchost.exe 2576 svchost.exe 1636 explorer.exe 2576 svchost.exe 1636 explorer.exe 2576 svchost.exe 1636 explorer.exe 2576 svchost.exe 1636 explorer.exe 2576 svchost.exe 1636 explorer.exe 2576 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1636 explorer.exe 2576 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 1636 explorer.exe 1636 explorer.exe 1580 spoolsv.exe 1580 spoolsv.exe 2576 svchost.exe 2576 svchost.exe 2644 spoolsv.exe 2644 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1636 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1636 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1636 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1636 2844 49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe 28 PID 1636 wrote to memory of 1580 1636 explorer.exe 29 PID 1636 wrote to memory of 1580 1636 explorer.exe 29 PID 1636 wrote to memory of 1580 1636 explorer.exe 29 PID 1636 wrote to memory of 1580 1636 explorer.exe 29 PID 1580 wrote to memory of 2576 1580 spoolsv.exe 30 PID 1580 wrote to memory of 2576 1580 spoolsv.exe 30 PID 1580 wrote to memory of 2576 1580 spoolsv.exe 30 PID 1580 wrote to memory of 2576 1580 spoolsv.exe 30 PID 2576 wrote to memory of 2644 2576 svchost.exe 31 PID 2576 wrote to memory of 2644 2576 svchost.exe 31 PID 2576 wrote to memory of 2644 2576 svchost.exe 31 PID 2576 wrote to memory of 2644 2576 svchost.exe 31 PID 1636 wrote to memory of 3024 1636 explorer.exe 32 PID 1636 wrote to memory of 3024 1636 explorer.exe 32 PID 1636 wrote to memory of 3024 1636 explorer.exe 32 PID 1636 wrote to memory of 3024 1636 explorer.exe 32 PID 2576 wrote to memory of 2468 2576 svchost.exe 33 PID 2576 wrote to memory of 2468 2576 svchost.exe 33 PID 2576 wrote to memory of 2468 2576 svchost.exe 33 PID 2576 wrote to memory of 2468 2576 svchost.exe 33 PID 2576 wrote to memory of 1524 2576 svchost.exe 38 PID 2576 wrote to memory of 1524 2576 svchost.exe 38 PID 2576 wrote to memory of 1524 2576 svchost.exe 38 PID 2576 wrote to memory of 1524 2576 svchost.exe 38 PID 2576 wrote to memory of 1616 2576 svchost.exe 40 PID 2576 wrote to memory of 1616 2576 svchost.exe 40 PID 2576 wrote to memory of 1616 2576 svchost.exe 40 PID 2576 wrote to memory of 1616 2576 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:52 /f5⤵
- Creates scheduled task(s)
PID:2468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:53 /f5⤵
- Creates scheduled task(s)
PID:1524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:54 /f5⤵
- Creates scheduled task(s)
PID:1616
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:3024
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD57a6598fc132c4b2e0fd143adf5bd2f88
SHA10d751ac6dd2834955e60d2903a4de8b943d7f3ef
SHA256b27e5efc1f4420306cd70542fd5ec9b06a3003b47d67020267cb52f11dca798a
SHA51230ecd3726dc1e55282e351e874d6769b461bf5957d96361dd7fd5d12d5ebf959b218fba880a7238e9ed3f17b664c6472d68817cc1996aa19de6496d92b1dda66
-
Filesize
135KB
MD51b19126cf13e89042c4ef357a1e96544
SHA1de1d63d1c585d1c22fe985c48080cf5673654188
SHA256bda4466c0e502493b077fc1d467c188cb6eb5595a95ce65dccf65afcf335df1f
SHA51257dfed0eddd40f98b714b21612a204863ffed353ab54b17c240b2281e925e375c2eec14cbdd4f7f0b81ffd5ce9612099e47ced8a495fefba25c666ac7e50c043
-
Filesize
135KB
MD5fb956c2b3a0bd7182870b3b0ce69c19f
SHA1a9cefd00315315fe3e659b9dd7f1587aa5410c9a
SHA2565edb75fd4b4cf1d00edf77417a7632b7166776b9ca6f69ad5339a44b856044f6
SHA5120bba0cc79f3d3e3d79234a1cb7f5de55a6d3698182f155e40d8553fbff5e9506a3a80e7d8fd3895804b4046c8fccbed2fb67b24bef0d004eaee6142ae77b5f49