Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/06/2024, 14:04
General
-
Target
190bae0b183e13a654588366c5ca07d0_NeikiAnalytics.dll
-
Size
524KB
-
MD5
190bae0b183e13a654588366c5ca07d0
-
SHA1
97b8da075134a7ab61c6c6b50ac357a92a42dad6
-
SHA256
6e0446640483ca2a1d0d531ed788c251b03fe573b95969bf5b1a60c4759bd0e3
-
SHA512
1c83c7456932b0b6e701df39d4493b315e0896827a74f942fcd801b883b6991b354bef15e14459bde6fcda9f00b835e88db847696ff5ffece1464b13190070bc
-
SSDEEP
6144:/i05kH9OyU2uv5SRf/FWgFgtYgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:6rHGPv5SmptFDmUWuVZkxikdXcq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\190bae0b183e13a654588366c5ca07d0_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\q3pCM.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{f88aa085-2df5-1d76-19b1-e998b140f7f3}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{f88aa085-2df5-1d76-19b1-e998b140f7f3}"2⤵
-
-
C:\Windows\system32\TSWbPrxy.exeC:\Windows\system32\TSWbPrxy.exe1⤵
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\HnDL6.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\tcM5cNu.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Trqxvscxs" /SC minute /MO 60 /TR "C:\Windows\system32\2517\Utilman.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD5953c419501c7c0c81542111a7bff2702
SHA129b098d7b6f8566f6a7ed74493a50b855f8bca4a
SHA256072199a04a1bd10862021e9fe90c32e5afc6fbd96e7cb1333a9739473eee8629
SHA51214d69c3813d7cc5c1235be1d4544ec2674931ec04c2047d44391372e4c4e5f140d98f90bf1c4a36da9e9fec2650958b49c1439ce5e047c0c9190eb40d737ed70
-
Filesize
528KB
MD5991923a382c9fe08517d41cf8bbab05a
SHA10744bee2942d68dc86a74784c71ad22d326ffa29
SHA256b0db07be931aab049f11b2dea3565fbb550162611743c123d43860ebc97772d2
SHA512952dd5010d83730b0b62041b7307e59785c8de19200c2c033c46d33eb60ae3cdb53cd84c994498fd1779695831321c82bcd69c824d23051d5939d23cbf2a8d34
-
Filesize
233B
MD5ec2383d801f56c8fe4ea761ee6d34d95
SHA185efc26c0feb910ed34527171d0ce4aa31b27a45
SHA25610fb22d02c568cce8d1e4ccb9cb9a9b514111484e1ce3e4202f846af46cef090
SHA51292a40fc18e82f70082ea9b785bc800e0f89af994114a88e4f4326ab12f21850e3b51d11e223277080f8051836adde0a04c4512e67643aa36b33152ca645d4ddd
-
Filesize
127B
MD54ef0a794a71b077c80d396c15883e895
SHA1b98a72fad46e8023591fc4edcbe06ceabd0bff32
SHA256708bbebab884cb3f7fe7cffd98749948877561648a8268489ce9473fb39ed9b9
SHA51262de6f7c7eb52f1ea97e533b546f226bde93457b25d8f2a473255216ea44e7525d2c30d2615a50ea997b06da1a158c3116d8b0feae0e73b7519803d4667ae300
-
Filesize
732KB
MD5f187e40ada53cdfb9e6cf7cd9983cc3a
SHA1347fc758d6e0abfb4399f648d2e33c0ff6d2048f
SHA256933f709685279a93a0812de750321cd8575443f35f0c93f7bedea3d1e4854f7c
SHA512a66295f57f7034b97b93e45dac9243ba5468fcc0f9a9383138927088a602df937b8500626841af0720110b7cc317cb71ab3d9635b605a085d84164400f8273e9
-
Filesize
894B
MD5f7e910515720ae290c719753bdd71173
SHA1a1a9346ca7a17390bf236c31df30af4efaa8eeec
SHA2565e9e9870971a54ed3a12759356a35ca583227d0575f84f1f0770111e8efea891
SHA512f1c977c8cf3f37d4574c797f6d2dd699e6c41a1e862dbac95725f54bdfa2a5edc85481a38466dc497bdcb2938e34c9237e5376b4709df8cd14bac30f4920f02c
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
524KB
-
Filesize
4KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
28KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
4KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
524KB
-
Filesize
28KB
-
Filesize
524KB