Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
11/06/2024, 21:44
General
-
Target
06038fedf29979d267f9663315865c20_NeikiAnalytics.dll
-
Size
496KB
-
MD5
06038fedf29979d267f9663315865c20
-
SHA1
c7b03dc841966e43a4d788848412c3e39cd42033
-
SHA256
13c23529ee4ebea3fef8f77517e07c7d8392729e48b72fb289b241113763c9f0
-
SHA512
e24f3f831f9a40d598c9272b5e383a286f4bff57b4b359177030f7017f6fac9b2561de98cb8129a982748d07a98f687137cd2ab45c21357cb4bddc978f945465
-
SSDEEP
6144:ui05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukTg:BrHGPv5Smpt6DmUWuVZkxikdXcq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06038fedf29979d267f9663315865c20_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wsmprovhost.exeC:\Windows\system32\wsmprovhost.exe1⤵
-
C:\Windows\system32\VSSVC.exeC:\Windows\system32\VSSVC.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\B0C.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6a238b75-ab6b-0508-5bd0-5c205cafaf63}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6a238b75-ab6b-0508-5bd0-5c205cafaf63}"2⤵
-
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\QLylw.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\hTbdi.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Hplnwst" /SC minute /MO 60 /TR "C:\Windows\system32\5023\rrinstaller.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD5baa3f524475218894bafc5013c3bbdf4
SHA1612380c3e22146f052482dbf7d56f499f7fa2958
SHA256120a71dc02c8dc8407364a44ec6ef546dd41209cd7aeb324321e6f93c6b029d0
SHA512aa1bd3b9d1309fab6e6c3f1ca247c4e7ec61910c98909b8021806e7311e60800b804dbd740038926e6d48a871126d75d899febbfc7f18da0115d17cdd75e4157
-
Filesize
224B
MD55b5fa812a6d447b3d77b97f8e943d17c
SHA1800fed7b88b61214fe881561431fbe4134a771b1
SHA256fb677b31a19804e74cc11944d0669bc8f1b69e4eb4d8a99810bda20a8c3fccbe
SHA512cd370b4aff12b011a0c711a096aa673861fa2957568b00ff550af82a3b015e55ac542953b9b949cc323954595b4cfec119527965847366cda730532b6614bf33
-
Filesize
197B
MD54c61c1823508360942f0ff5841d68515
SHA180d2f7c478909f5ba40157b4a9f9f5d839a3d174
SHA2564b31c556ca83bd31f55ce164652ed43e23abc4b22695e32348fe0d79c4609057
SHA512b26ed2d8f03ac572b1b190a959657d8b0f5c6815c6aead6f245251134ca2f0dfc47b0e8f72c03e1652f26352c16e9ac62eb1ef4d4440f201292e282e9d773f57
-
Filesize
500KB
MD5b4b5c0ec47711c2448ea920b8d93019e
SHA1744b5ae770b9e43b0ea8efdcca4f1ccd7cad6b35
SHA256011924f11144fccdcc7f26a8ea35600b27aa94714780eb9b43d46b1c38bb6a39
SHA51234ae369d58d41f2bff257a0411c3d0dde36da6c11db14461733f0a81e0e36334bf9a9818b04a2e7923b6a1a9e0af08468a0989cd04c655f2c4c42f2d1fe72da3
-
Filesize
129B
MD528de8a6a241e5f4dd1c12bed2b2d909d
SHA19d237dffdd94c15791b9f3a943e7f510bd086867
SHA256d29c39eabca8a3d8153fc44d9a2d4851d03403f05ea8a23e6e988c49304629c3
SHA512ca7c36df4aa72c075c414bdb30ec4e6db0e4e0b9c6d0bbad5171da3452fdcc5b1a22f95c48db6cfd2609086c189f09296b6b3fb6c75608730d39ba497ea003b0
-
Filesize
864B
MD5e0d47cc9af5e2bafa92a52bf90e267d3
SHA1ec4e82d4e5660b186696a7a19b97260fce3f3a42
SHA256d3eac766d80ed356c06fc427aa177e867d5511bca5f8566650a48e09506e8730
SHA512f11a73ff364d2566315bcaafc47c6846783db2c3c20ebc7373c011b94e614e82a01707c3a3d68dfdaf98ef80a143369a334b0284dabe364472a9c7f3d01292ab
-
Filesize
1.5MB
MD5b60ba0bc31b0cb414593e169f6f21cc2
SHA11d6f5a5de7154b75144c6a033c36fd86ff2bbe9b
SHA25647b801e623254cf0202b3591cb5c019cabfb52f123c7d47e29d19b32f1f2b915
SHA5121c194674435e3a9ae7eb3475f6f3d4a82eddd04d3d06a2b1858edfe9830a989cbd474395f700bc7a68870f685c431304cf3a67f31169ef699fb575a831b49531
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
4KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
28KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
4KB
-
Filesize
496KB
-
Filesize
8KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
496KB
-
Filesize
28KB
-
Filesize
496KB