Analysis

  • max time kernel
    16s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 03:12 UTC

General

  • Target

    322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe

  • Size

    5.3MB

  • MD5

    322e5a0f773010dfd2165cd3b00986c0

  • SHA1

    e42b60b12ca5477920e447de087587eb9b3285fb

  • SHA256

    cd0b5bf86e89959eaaa79ce2c1d30eb619a28850fdddab64bded9dfe7971fad2

  • SHA512

    e101cda9f5a8fcf0e52489e385ffc88055fcc22792ebb6b7655b032f526d2002e52710ff1dd5a03b1f2b3a18e8b9ec0ee11f75ed431b308e37008186f90bc632

  • SSDEEP

    98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4048
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4804
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
          PID:2052
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        2⤵
        • Launches sc.exe
        PID:1880
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        2⤵
        • Launches sc.exe
        PID:4440
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop wuauserv
        2⤵
        • Launches sc.exe
        PID:4384
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop bits
        2⤵
        • Launches sc.exe
        PID:1432
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop dosvc
        2⤵
        • Launches sc.exe
        PID:3296
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1288
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3892
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5108
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1444
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe delete "JIOGRCSG"
        2⤵
        • Launches sc.exe
        PID:524
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"
        2⤵
        • Launches sc.exe
        PID:2780
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop eventlog
        2⤵
        • Launches sc.exe
        PID:3956
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start "JIOGRCSG"
        2⤵
        • Launches sc.exe
        PID:3916
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 3
          3⤵
            PID:1752
      • C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe
        C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:616
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2784
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          2⤵
            PID:4036
            • C:\Windows\system32\wusa.exe
              wusa /uninstall /kb:890830 /quiet /norestart
              3⤵
                PID:3452
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop UsoSvc
              2⤵
              • Launches sc.exe
              PID:4664
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop WaaSMedicSvc
              2⤵
              • Launches sc.exe
              PID:2672
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop wuauserv
              2⤵
              • Launches sc.exe
              PID:1964
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop bits
              2⤵
              • Launches sc.exe
              PID:1164
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop dosvc
              2⤵
              • Launches sc.exe
              PID:3104
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              2⤵
                PID:756
              • C:\Windows\system32\powercfg.exe
                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                2⤵
                  PID:2824
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  2⤵
                    PID:1696
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    2⤵
                      PID:3472
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      2⤵
                        PID:3412
                      • C:\Windows\system32\nslookup.exe
                        nslookup.exe
                        2⤵
                          PID:2940

                      Network

                      • flag-us
                        DNS
                        58.55.71.13.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        58.55.71.13.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        91.90.14.23.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        91.90.14.23.in-addr.arpa
                        IN PTR
                        Response
                        91.90.14.23.in-addr.arpa
                        IN PTR
                        a23-14-90-91deploystaticakamaitechnologiescom
                      • flag-us
                        DNS
                        23.159.190.20.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        23.159.190.20.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        95.221.229.192.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        95.221.229.192.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        228.249.119.40.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        228.249.119.40.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        us-zephyr.miningocean.org
                        Remote address:
                        8.8.8.8:53
                        Request
                        us-zephyr.miningocean.org
                        IN A
                        Response
                        us-zephyr.miningocean.org
                        IN A
                        15.204.240.197
                        us-zephyr.miningocean.org
                        IN A
                        15.204.244.104
                      • flag-us
                        DNS
                        197.240.204.15.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        197.240.204.15.in-addr.arpa
                        IN PTR
                        Response
                        197.240.204.15.in-addr.arpa
                        IN PTR
                        vps-0a583ba3vpsovhus
                      • flag-us
                        DNS
                        103.169.127.40.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        103.169.127.40.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        18.31.95.13.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        18.31.95.13.in-addr.arpa
                        IN PTR
                        Response
                      • flag-us
                        DNS
                        31.243.111.52.in-addr.arpa
                        Remote address:
                        8.8.8.8:53
                        Request
                        31.243.111.52.in-addr.arpa
                        IN PTR
                        Response
                      • 15.204.240.197:5432
                        us-zephyr.miningocean.org
                        tls
                        1.7kB
                        5.6kB
                        10
                        10
                      • 8.8.8.8:53
                        58.55.71.13.in-addr.arpa
                        dns
                        70 B
                        144 B
                        1
                        1

                        DNS Request

                        58.55.71.13.in-addr.arpa

                      • 8.8.8.8:53
                        91.90.14.23.in-addr.arpa
                        dns
                        70 B
                        133 B
                        1
                        1

                        DNS Request

                        91.90.14.23.in-addr.arpa

                      • 8.8.8.8:53
                        23.159.190.20.in-addr.arpa
                        dns
                        72 B
                        158 B
                        1
                        1

                        DNS Request

                        23.159.190.20.in-addr.arpa

                      • 8.8.8.8:53
                        95.221.229.192.in-addr.arpa
                        dns
                        73 B
                        144 B
                        1
                        1

                        DNS Request

                        95.221.229.192.in-addr.arpa

                      • 8.8.8.8:53
                        228.249.119.40.in-addr.arpa
                        dns
                        73 B
                        159 B
                        1
                        1

                        DNS Request

                        228.249.119.40.in-addr.arpa

                      • 8.8.8.8:53
                        us-zephyr.miningocean.org
                        dns
                        71 B
                        103 B
                        1
                        1

                        DNS Request

                        us-zephyr.miningocean.org

                        DNS Response

                        15.204.240.197
                        15.204.244.104

                      • 8.8.8.8:53
                        197.240.204.15.in-addr.arpa
                        dns
                        73 B
                        110 B
                        1
                        1

                        DNS Request

                        197.240.204.15.in-addr.arpa

                      • 8.8.8.8:53
                        103.169.127.40.in-addr.arpa
                        dns
                        73 B
                        147 B
                        1
                        1

                        DNS Request

                        103.169.127.40.in-addr.arpa

                      • 8.8.8.8:53
                        18.31.95.13.in-addr.arpa
                        dns
                        70 B
                        144 B
                        1
                        1

                        DNS Request

                        18.31.95.13.in-addr.arpa

                      • 8.8.8.8:53
                        31.243.111.52.in-addr.arpa
                        dns
                        72 B
                        158 B
                        1
                        1

                        DNS Request

                        31.243.111.52.in-addr.arpa

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe

                        Filesize

                        192KB

                        MD5

                        af1273490d335d5770d8be7c32382b49

                        SHA1

                        7fda952bbf059cb73206c59266216a829bed3d78

                        SHA256

                        f733c2398a8fe112d6b4a0ee4c39083ac74496d8c27b337b2a0ab162393ae60b

                        SHA512

                        318231c6408bbca11e43c4ff8c13b62b3788714ef229c4d2ba0a953705c2f21b1e3b9981b3af7a197a4d8f14567a40bf09efc4e2a029da53fc1ea7dcc573cb12

                      • C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe

                        Filesize

                        576KB

                        MD5

                        44d0f03dc262325b83399f69727869f3

                        SHA1

                        3edd13183d1ccfd2f46f6bc387a12fe09ae6329d

                        SHA256

                        ad2cdc6fcfaef90ef0160215c6b652c48206cfa1e84fccd981966165f4299fcd

                        SHA512

                        92b5190c17efdf5d6c4a920a2dec29e32186dc6c4a308a4604f0f8e0edba9ca0ea497e03397e668522072f3e9cfe6b71f2a420d4cf893c7d4cff305da2584ed3

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k05k5a2z.wty.ps1

                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • memory/2784-41-0x0000023CE7F50000-0x0000023CE7F5A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2784-43-0x0000023CE7F60000-0x0000023CE7F68000-memory.dmp

                        Filesize

                        32KB

                      • memory/2784-45-0x0000023CEA540000-0x0000023CEA54A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2784-44-0x0000023CE7F70000-0x0000023CE7F76000-memory.dmp

                        Filesize

                        24KB

                      • memory/2784-42-0x0000023CEA520000-0x0000023CEA53A000-memory.dmp

                        Filesize

                        104KB

                      • memory/2784-37-0x0000023CE7F30000-0x0000023CE7F4C000-memory.dmp

                        Filesize

                        112KB

                      • memory/2784-38-0x0000023CEA300000-0x0000023CEA3B5000-memory.dmp

                        Filesize

                        724KB

                      • memory/2784-39-0x0000023CE7F20000-0x0000023CE7F2A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2784-40-0x0000023CEA500000-0x0000023CEA51C000-memory.dmp

                        Filesize

                        112KB

                      • memory/2940-65-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-62-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-73-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-72-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-71-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-69-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-57-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-58-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-56-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-66-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-68-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-64-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-67-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-59-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-63-0x00000226FB450000-0x00000226FB470000-memory.dmp

                        Filesize

                        128KB

                      • memory/2940-60-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-61-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/3412-52-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-55-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-50-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-49-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-48-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-51-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/4804-15-0x00007FF91A970000-0x00007FF91B431000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/4804-0-0x00007FF91A973000-0x00007FF91A975000-memory.dmp

                        Filesize

                        8KB

                      • memory/4804-1-0x000001D4DEE20000-0x000001D4DEE42000-memory.dmp

                        Filesize

                        136KB

                      • memory/4804-11-0x00007FF91A970000-0x00007FF91B431000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/4804-12-0x00007FF91A970000-0x00007FF91B431000-memory.dmp

                        Filesize

                        10.8MB

                      We care about your privacy.

                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.