bfccbb929a14b8f43824c57f57daca68d8e920e0bff08dee146049b6671dde87

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Size

29KB
MD5

935ac65840d05b241d880e4854e513a0
SHA1

95ffa46a81f942264d06854d94bbf570cba695b7
SHA256

bfccbb929a14b8f43824c57f57daca68d8e920e0bff08dee146049b6671dde87
SHA512

3392a89cba6f6011390a57464568b8e5316e218b147152aba2c1618ae30050073788a79cc752eae9edf04d046087de5dc35cc39d6db0993e04181569e72beadd
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Y:AEwVs+0jNDY1qi/qA

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2040 services.exe

pid	process
2040	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2656-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2656-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral1/memory/2040-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-17-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-18-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-23-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-42-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-47-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-48-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmp675B.tmp	upx
behavioral1/memory/2656-65-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-67-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-72-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-78-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2656-79-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2040-80-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2040-85-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\services.exe	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
File created	C:\Windows\java.exe	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe

description	pid	process	target process
PID 2656 wrote to memory of 2040	2656	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe
PID 2656 wrote to memory of 2040	2656	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe
PID 2656 wrote to memory of 2040	2656	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe
PID 2656 wrote to memory of 2040	2656	935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\935ac65840d05b241d880e4854e513a0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
cc8d9dfa4711dc4d0f0cbb7a0622af22

SHA1
0b1535253aa693158346d5767661903455ee4a1a

SHA256
5acb318644ff4380fa1626dcec54c1a5ba678c6192a012db74030f2ed49ee42f

SHA512
268e9767aab0ecef0f43c5a24e28d15cf7cf5efe4403c2305e8b1eab859e19717f30f9274ef90c0c0be74d8e19367862da5a24929efe48eef2828d3a6a09ec74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
75d4ff0cfc3500cce4f3a0536d1d259c

SHA1
b59cf31b32976541e763a8b6ed2aa032f16f2f26

SHA256
6d570dfda49a14d8ad5c3f74dea279fc4d228b6741f0bedcc39ad937fcdf55b2

SHA512
b5baf353b1db315b7d4592666976d5dd54466206f1914fc35b3256eaa7e7cdcdcd388d804e5f052bb927a3774879c9e16795dcdf63934f6fc453ba86a5d1e1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
10f16ab039fbe2d074f54715162b516a

SHA1
bdb10f2ae77555f2ebcab4990b55c6fee486d73d

SHA256
1df1984dbe850f111379b4bb14afd82d92d03a7954500f11e3f2ce546c43e429

SHA512
45baa87536488a9711d90614ee0dce31639701ead59f63c044e7839dc9bde4a2ca0bacba2d5647ae5258e63725cd4a9d9d45ac184eed5f23e93a1a2c5a35c7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a6dc090f86b2527e65a1389756cb8606

SHA1
da394d48f5cca7a15a486165167f05fedf874f10

SHA256
5092137c5b41395cfd1ce45fd468cd19a8dbbc118fd8667764bdb0c3a64f149d

SHA512
ebf28024453cc2a5d55591bc2da414169abf59c8e8ba7eff4d81819242f65068eab5f3eae25425a6ae2a9f33f79a9b5d8d45b8165c1e9229b587c6fe8e5d29b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6527.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp675B.tmp
Filesize
29KB

MD5
72e86163f06f69fa75daafe375710a81

SHA1
63ea43165cfc5e49440e890a2cea005cde32eee5

SHA256
70fd231f705aebedf413e26ef6c301b40f2fe3b508912fc5ba37fd401389af61

SHA512
321e061b96411506bf98a7b4630213245f4be48adccf3a06d3fe83cf36ae51077853c2f85faeb8e9e60f12bf65ca9e3124b30b86ba85435eaea82e79c3e61e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ynkckbez.log
Filesize
288B

MD5
5f2a225c2b17702fde73c25ab2756499

SHA1
0825ff620e90a1f5d3919cb50cf0daa1dac1aa06

SHA256
d339c0debf5302678f5b38a9c126b0247261770df6a92a67d00165ae01a79da1

SHA512
b061254803a2022bcd06d2262d22d521dc6d220e48ac6724a2894dd96a4259425baebbaadaea198a32f0de6a960a4600d2b4e41beb0134727a37cf1d5f24303f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
c823a6ba3020107014d0a86e2ebb6d9d

SHA1
28e162ee97766c06b4091fdcf75786c389670751

SHA256
6cfb9e196f59020bd29d01f522143bcc3362b789be6f783aa0aaae83f768dbde

SHA512
76d89b64b64e76f049d49232c6f7c81e126cfde79e42a23db8ff5cf487a462e19dc31fd22aa47ccfc3dd4fcb37d8de4b42a13fa593522c6c2444c39769821e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
320B

MD5
a9a34d3991648fafc6f0fb0f5445389d

SHA1
6b7ac04003353421701483cbd9289f47c8dc2290

SHA256
50f0dc7649848edea324ee6206d07ab4079bf282ee544c8896b9b2c59f2fda03

SHA512
3f94bd35508303ea9ceffb97273261cd8ef2cd907b81e5045f2bc67c6abec39acb7d63d6259d51590bfc3941a59b59ba66295eb012981b8423cf6d6ddb629c36

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2040-78-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-36-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-48-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-80-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-85-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-72-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-79-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-67-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-65-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-47-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-17-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2656-42-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2656-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download