ccaa66f746631c0a50b471d1e0cc1254c1b43560a5c457eb55ffdbc46a12f0c7

Analysis

max time kernel
140s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Size

794KB
MD5

87bcf4955374c9c3f5a33a69ad2fac90
SHA1

85456342e1c5ee1285b62f072f0fd5d463630373
SHA256

ccaa66f746631c0a50b471d1e0cc1254c1b43560a5c457eb55ffdbc46a12f0c7
SHA512

b5dc4a3701ea59d63e4eb149d880535b8b5d1dc5fa36256291feb1172ff4bda89f93ffe75fec3109413ff3c36d93903988cc0bfa4b8f044b54c79468cf9a371c
SSDEEP

12288:M8kxNhOZElO5kkWjhD4AysGtAtScw3qEKBYG:jqEkfF6145

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5064	GLR.EXE

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	GLR.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\$Recycle.Bin\\IYE.EXE \"%1\" %*"	GLR.EXE

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/960-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/files/0x0007000000023416-10.dat	upx
behavioral2/files/0x00080000000232a4-21.dat	upx
behavioral2/memory/5064-23-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/960-25-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/5064-29-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RPA.EXE = "C:\\Users\\GMZOWT.EXE"	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\N:	GLR.EXE
File opened (read-only)	\??\P:	GLR.EXE
File opened (read-only)	\??\Q:	GLR.EXE
File opened (read-only)	\??\G:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\H:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\K:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\N:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\K:	GLR.EXE
File opened (read-only)	\??\L:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\S:	GLR.EXE
File opened (read-only)	\??\V:	GLR.EXE
File opened (read-only)	\??\O:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\G:	GLR.EXE
File opened (read-only)	\??\U:	GLR.EXE
File opened (read-only)	\??\E:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\I:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\U:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\V:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\M:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\R:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\E:	GLR.EXE
File opened (read-only)	\??\J:	GLR.EXE
File opened (read-only)	\??\R:	GLR.EXE
File opened (read-only)	\??\S:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\T:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\H:	GLR.EXE
File opened (read-only)	\??\L:	GLR.EXE
File opened (read-only)	\??\T:	GLR.EXE
File opened (read-only)	\??\P:	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
File opened (read-only)	\??\I:	GLR.EXE
File opened (read-only)	\??\M:	GLR.EXE
File opened (read-only)	\??\O:	GLR.EXE

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\NXUFUP.EXE %1"	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\PerfLogs\\ZAV.EXE \"%1\""	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Users\\GMZOWT.EXE \"%1\""	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	GLR.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Users\\NXUFUP.EXE %1"	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\Users\\GMZOWT.EXE %1"	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\$Recycle.Bin\\IYE.EXE \"%1\" %*"	GLR.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\Users\\GMZOWT.EXE \"%1\" %*"	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5064	GLR.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 5064	960	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe	82
PID 960 wrote to memory of 5064	960	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe	82
PID 960 wrote to memory of 5064	960	87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\87bcf4955374c9c3f5a33a69ad2fac90_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:960
- C:\PerfLogs\GLR.EXE
  C:\PerfLogs\GLR.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\GLR.EXE

Filesize
794KB

MD5
6df7d6e204f224c2ab9c5b8909bbc226

SHA1
4ed37688c0d4857f81dccf40f4cd62897e854ffb

SHA256
bbf8028caccba2e671411d2ce1d8860cf0529c55a488c5dc5d273f3611dc3770

SHA512
b9dbb8689956c5338fffb0b5e4e0afcb275f882f2d3c8b758d2fba6f62f1235adbc0de88f43418e13b00637003a7edec852d11b8ad7b0009c1ab8428c23e4dd1

Download Submit
C:\PerfLogs\ZAV.EXE

Filesize
794KB

MD5
66e8e13eea6ba160fbb7c9a6e1a282d6

SHA1
73694bc1a0c5f321a515f5e58ede7ba333738fda

SHA256
ee429dc549553321af603a002171c20b84acb529128793a207d89f709e83b4a7

SHA512
bda225969f7233007b2da173551f37fe143f6c323545f00aba24f3eba6a00cf82b1663d3f5d58690f32ad8fface37034f5ecd2988cc6e9aae4662dbe61256225

Download Submit
\??\c:\filedebug

Filesize
214B

MD5
e0fc5c880e78a4c3b711608e117d6583

SHA1
cbe8e6dfb575f0ff36a5ffde8bf28a5453e3b3dc

SHA256
9c8ca092c8368f43c1d9b804970a085cb3ec7f1907638c8c7e60ec0c2a0b8474

SHA512
8589c25a1c7756609f6337f6a586455f26da6fd96efe03847c0e406202f519ed059014f3ee377488fcff402b4603c1a2b51d421665c30fce7d8673854708fb22

Download Submit
memory/960-0-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/960-3-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/960-25-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/5064-23-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/5064-24-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/5064-29-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/5064-30-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads