Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 12:33
Behavioral task
behavioral1
Sample
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe
-
Size
130KB
-
MD5
547d1862283cf98ea6bc173e52827c50
-
SHA1
cb1ec8704e16b78d75cad58d9f04d4141292e988
-
SHA256
3fd05d49ec653606b24e10d604d4e19723c5a9cfe844818764508d095856285b
-
SHA512
b8e12a0c96abf5c680f7b05ac54e38098c9e99e7c39193eeb34137926f9e8fb6de44311aa3dad1abaacfa222a2bc4a8f72a9eead0959757528f5a34bedf1cd28
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZ:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4060-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4060-54-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4060-53-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4060-46-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4060-43-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/4060-59-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 2492 Flaseher.exe 2920 Flaseher.exe 4060 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/1228-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1228-10-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2008-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2008-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2008-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2492-35-0x0000000000400000-0x0000000000423000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/2492-38-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2492-39-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2008-56-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2492-55-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2008-51-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2492-40-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2920-58-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 1228 set thread context of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 2492 set thread context of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 set thread context of 4060 2492 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe Token: SeDebugPrivilege 2920 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 2492 Flaseher.exe 2920 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 1228 wrote to memory of 2008 1228 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe PID 2008 wrote to memory of 1032 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe cmd.exe PID 2008 wrote to memory of 1032 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe cmd.exe PID 2008 wrote to memory of 1032 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe cmd.exe PID 1032 wrote to memory of 4744 1032 cmd.exe reg.exe PID 1032 wrote to memory of 4744 1032 cmd.exe reg.exe PID 1032 wrote to memory of 4744 1032 cmd.exe reg.exe PID 2008 wrote to memory of 2492 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe Flaseher.exe PID 2008 wrote to memory of 2492 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe Flaseher.exe PID 2008 wrote to memory of 2492 2008 547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 2920 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe PID 2492 wrote to memory of 4060 2492 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\547d1862283cf98ea6bc173e52827c50_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CQPBK.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CQPBK.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD55d84168c596e44d9e6429e4731147ed9
SHA13c23aba5484630ce49f5c478ef0eb974429d8be7
SHA256a2fe47b2cbb8ff6f767b89d37720d8b2b8134ed698f70c50238d2d7b83ba3ae6
SHA5124a185835f6ef980927c95a2f08c2aa4f33c67d4739794ff1cdb0aed1c4a3da6178ff4aa9e67f5969a7c0cd5d00e417260cdc03215caaefd699b8df6db4f3a114
-
memory/1228-3-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/1228-10-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1228-7-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/1228-4-0x0000000002AA0000-0x0000000002AA1000-memory.dmpFilesize
4KB
-
memory/1228-5-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/1228-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2008-56-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2008-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2008-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2008-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2008-51-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2492-38-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2492-39-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2492-55-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2492-35-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2492-40-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2920-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4060-49-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4060-54-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4060-53-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4060-46-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4060-43-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/4060-59-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB