45dcafae58a2a7af6b48910326684df5b4363623a2225b2149ae2755afadf7a9

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
Size

70KB
MD5

6b71e456f254168cf5246a28ffb1a490
SHA1

0c7dd7f2b19d2a0621801d7b764c98bf89e84c9f
SHA256

45dcafae58a2a7af6b48910326684df5b4363623a2225b2149ae2755afadf7a9
SHA512

35d530ba729030fc075a48a519e55f334e4b4241259a863dfab443cc8c2b556a9a3b06beaf4e9963524c6938c900155634596c76986306726fa726ec349feaf8
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8E:Olg35GTslA5t3/w8E

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ikgoapeam.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\IsInstalled = "1"	ikgoapeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}\StubPath = "C:\\Windows\\system32\\ifxaneam.exe"	ikgoapeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{55485251-4b4a-4350-5548-52514B4A4350}	ikgoapeam.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	ikgoapeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	ikgoapeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ahbatooc-odac.exe"	ikgoapeam.exe

Executes dropped EXE 2 IoCs

pid	Process
2852	ikgoapeam.exe
2060	ikgoapeam.exe

Loads dropped DLL 3 IoCs

pid	Process
2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
2852	ikgoapeam.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	ikgoapeam.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	ikgoapeam.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ibkumoag-oumom.dll"	ikgoapeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	ikgoapeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	ikgoapeam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ikgoapeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	ikgoapeam.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ifxaneam.exe	ikgoapeam.exe
File opened for modification	C:\Windows\SysWOW64\ikgoapeam.exe	ikgoapeam.exe
File created	C:\Windows\SysWOW64\ahbatooc-odac.exe	ikgoapeam.exe
File created	C:\Windows\SysWOW64\ikgoapeam.exe	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\ahbatooc-odac.exe	ikgoapeam.exe
File opened for modification	C:\Windows\SysWOW64\ifxaneam.exe	ikgoapeam.exe
File opened for modification	C:\Windows\SysWOW64\ibkumoag-oumom.dll	ikgoapeam.exe
File created	C:\Windows\SysWOW64\ibkumoag-oumom.dll	ikgoapeam.exe
File opened for modification	C:\Windows\SysWOW64\ikgoapeam.exe	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2060	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe
2852	ikgoapeam.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
Token: SeDebugPrivilege	2852	ikgoapeam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2852	2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2852	2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2852	2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe	28
PID 2944 wrote to memory of 2852	2944	6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 432	2852	ikgoapeam.exe	5
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 2060	2852	ikgoapeam.exe	29
PID 2852 wrote to memory of 2060	2852	ikgoapeam.exe	29
PID 2852 wrote to memory of 2060	2852	ikgoapeam.exe	29
PID 2852 wrote to memory of 2060	2852	ikgoapeam.exe	29
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21
PID 2852 wrote to memory of 1188	2852	ikgoapeam.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Users\Admin\AppData\Local\Temp\6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\6b71e456f254168cf5246a28ffb1a490_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\ikgoapeam.exe
    "C:\Windows\system32\ikgoapeam.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\ikgoapeam.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ahbatooc-odac.exe

Filesize
73KB

MD5
bd152b52205971368b4bcee7194a452c

SHA1
f5279065149059487b04a97c3f99b8e9f4b27142

SHA256
5b097d010783a4fd83e5beaf02b00570b1ca8627e84aefadc4f4dcffd02d9917

SHA512
fbb9689a9580be23a13f79da859f3b0d388c774ad3eb85654025837ea38975889be352e57f3e7b0f6cc45e9ac949776a1890932f8be0facc3e39f7e14da4b770

Download Submit
C:\Windows\SysWOW64\ibkumoag-oumom.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ifxaneam.exe

Filesize
72KB

MD5
457a06a83825387413329290e7da3dff

SHA1
bbfb47c1f51d757b63f56b85d0b40d6b2ae52ade

SHA256
a4457be002e35dbe5863ee2f5a7c1ab9fc6d1e06ce28717e3c6ca475921429f8

SHA512
324b197fdfc1fe9aa4b7cb35212bab39a3cafe3b6603f7b2f3112cf93d18be4bb7a0ea9ab0ca1593c13b59e0eeaa5bbe44629c9db0447b05d0936599d397bc09

Download Submit
\Windows\SysWOW64\ikgoapeam.exe

Filesize
70KB

MD5
6b71e456f254168cf5246a28ffb1a490

SHA1
0c7dd7f2b19d2a0621801d7b764c98bf89e84c9f

SHA256
45dcafae58a2a7af6b48910326684df5b4363623a2225b2149ae2755afadf7a9

SHA512
35d530ba729030fc075a48a519e55f334e4b4241259a863dfab443cc8c2b556a9a3b06beaf4e9963524c6938c900155634596c76986306726fa726ec349feaf8

Download Submit
memory/2060-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2852-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2852-113-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2944-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download