Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 07:50

General

  • Target

    49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe

  • Size

    135KB

  • MD5

    49caa5edfc4e78f44f545d175ba9b5b0

  • SHA1

    ee61df54a4095b0b8c44541ce2409db8e69be51f

  • SHA256

    2d69a5b80c686a8297c15671404a80e39fe9c5d056d0a4e4cd717dbbb105c1c2

  • SHA512

    0b49b84199800d15eac0baeb754e91e01faaa27157843608555d8b7034159486052c658807217571a1e376631a281020e7d821511a47aefe99b0caa1a0fda34e

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVgt:UVqoCl/YgjxEufVU0TbTyDDalit

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\49caa5edfc4e78f44f545d175ba9b5b0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2844
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1636
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1580
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2576
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2644
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:52 /f
            5⤵
            • Creates scheduled task(s)
            PID:2468
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:53 /f
            5⤵
            • Creates scheduled task(s)
            PID:1524
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:54 /f
            5⤵
            • Creates scheduled task(s)
            PID:1616
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:3024

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\Resources\spoolsv.exe

            Filesize

            135KB

            MD5

            7a6598fc132c4b2e0fd143adf5bd2f88

            SHA1

            0d751ac6dd2834955e60d2903a4de8b943d7f3ef

            SHA256

            b27e5efc1f4420306cd70542fd5ec9b06a3003b47d67020267cb52f11dca798a

            SHA512

            30ecd3726dc1e55282e351e874d6769b461bf5957d96361dd7fd5d12d5ebf959b218fba880a7238e9ed3f17b664c6472d68817cc1996aa19de6496d92b1dda66

          • \Windows\Resources\Themes\explorer.exe

            Filesize

            135KB

            MD5

            1b19126cf13e89042c4ef357a1e96544

            SHA1

            de1d63d1c585d1c22fe985c48080cf5673654188

            SHA256

            bda4466c0e502493b077fc1d467c188cb6eb5595a95ce65dccf65afcf335df1f

            SHA512

            57dfed0eddd40f98b714b21612a204863ffed353ab54b17c240b2281e925e375c2eec14cbdd4f7f0b81ffd5ce9612099e47ced8a495fefba25c666ac7e50c043

          • \Windows\Resources\svchost.exe

            Filesize

            135KB

            MD5

            fb956c2b3a0bd7182870b3b0ce69c19f

            SHA1

            a9cefd00315315fe3e659b9dd7f1587aa5410c9a

            SHA256

            5edb75fd4b4cf1d00edf77417a7632b7166776b9ca6f69ad5339a44b856044f6

            SHA512

            0bba0cc79f3d3e3d79234a1cb7f5de55a6d3698182f155e40d8553fbff5e9506a3a80e7d8fd3895804b4046c8fccbed2fb67b24bef0d004eaee6142ae77b5f49

          • memory/1580-43-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/1636-13-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2576-38-0x0000000000360000-0x000000000037F000-memory.dmp

            Filesize

            124KB

          • memory/2644-42-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2844-0-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB

          • memory/2844-8-0x0000000000330000-0x000000000034F000-memory.dmp

            Filesize

            124KB

          • memory/2844-44-0x0000000000400000-0x000000000041F000-memory.dmp

            Filesize

            124KB