ba7ef0c2cd1846a95c2839cf2522a91d2df03d1dbd5d4ae7c95a0124f6677f61

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
Size 66KB
Sample240611-2k2aasvcpe
SHA256 ba7ef0c2cd1846a95c2839cf2522a91d2df03d1dbd5d4ae7c95a0124f6677f61
MD5 098d598a2e8e2889542b13a07e3f3d40
SHA1 27546fd2cb0b755447bab78ccafee3703b85f6fc
SHA512 ba9a2da32b88071f47301f2e95a6cd5286f41b46913d500a5a2814c611bbdb8e1351d0894e452a5b9a1880848cd9b843a72526ea4800383a56e4c902dc3b6c4c
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXirWWWWWWWWWWWWWWWWWWWWy:IeklMMYJhqezw/pXzH9irWWWWWWWWWWi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
3468	explorer.exe
2080	spoolsv.exe
4744	svchost.exe
4112	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
4744	svchost.exe
4744	svchost.exe
4744	svchost.exe
3468	explorer.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
4744	svchost.exe
3468	explorer.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
3468	explorer.exe
4744	svchost.exe
3468	explorer.exe
4744	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3468	explorer.exe
4744	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
3468	explorer.exe
3468	explorer.exe
2080	spoolsv.exe
2080	spoolsv.exe
4744	svchost.exe
4744	svchost.exe
4112	spoolsv.exe
4112	spoolsv.exe
3468	explorer.exe
3468	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3468	2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe	82
PID 2492 wrote to memory of 3468	2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe	82
PID 2492 wrote to memory of 3468	2492	098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe	82
PID 3468 wrote to memory of 2080	3468	explorer.exe	83
PID 3468 wrote to memory of 2080	3468	explorer.exe	83
PID 3468 wrote to memory of 2080	3468	explorer.exe	83
PID 2080 wrote to memory of 4744	2080	spoolsv.exe	85
PID 2080 wrote to memory of 4744	2080	spoolsv.exe	85
PID 2080 wrote to memory of 4744	2080	spoolsv.exe	85
PID 4744 wrote to memory of 4112	4744	svchost.exe	86
PID 4744 wrote to memory of 4112	4744	svchost.exe	86
PID 4744 wrote to memory of 4112	4744	svchost.exe	86
PID 4744 wrote to memory of 1472	4744	svchost.exe	87
PID 4744 wrote to memory of 1472	4744	svchost.exe	87
PID 4744 wrote to memory of 1472	4744	svchost.exe	87
PID 4744 wrote to memory of 3744	4744	svchost.exe	90
PID 4744 wrote to memory of 3744	4744	svchost.exe	90
PID 4744 wrote to memory of 3744	4744	svchost.exe	90
PID 4744 wrote to memory of 4116	4744	svchost.exe	92
PID 4744 wrote to memory of 4116	4744	svchost.exe	92
PID 4744 wrote to memory of 4116	4744	svchost.exe	92

C:\Users\Admin\AppData\Local\Temp\098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\098d598a2e8e2889542b13a07e3f3d40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3468
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4112
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1472
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3744
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 902665afc1b451ca49022cd26c159ec50e555ef19289929ef64ac19524949803
MD5 4dd2319fd5bbbc4574e91d6c5b55814b
SHA1 c9382a3fd13a1615044a390d959f8d930557383f
SHA512 0d0e33f6d69cdbc29583e88fce4bf9add2bee39dcb1ab90819d372da812865fcb1ea1e1548ded4b1464851a764387699b248c15efaf4023fc8a90dbda92f663c
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiG:IeklMMYJhqezw/pXzH9iG
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 2b5ab23c705df80a40c64e36724349229dbbfe711bad95cbf143e6ada54a5ff3
MD5 09795b52833b8f2e67d09ec00e1daf44
SHA1 7bfcea17b0a4454c4e0815bfd7ea9faa79bf1264
SHA512 273f163c7acb7b144cb7092a016265f1074df18a7a4c6f2deb70ff641ee040103c5402162325652902bf96988ef76dc992efd62702d8cb88cc9c715c2fec0ae0
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi8:IeklMMYJhqezw/pXzH9i8
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 ab74147c001572d1730584210a0e9ffe4fcb1c3331adc726b58663d5e9d806eb
MD5 e6a4a17a9bbc28ce9f39360df42b45ef
SHA1 cd22d1664d72f74129e356904ec5873e30e6776a
SHA512 3866ef04f1b2e51205034e7005840db9aae6552de39de8f9b14ac8832157427562f80e1ba81db1a2fc6a4125549d51ccaa5a3f4dad2c267d0234bcbaf1b9002e
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi1:IeklMMYJhqezw/pXzH9i1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 e892a904da4ea5731d18f9c3c16125e35422f12ce1170383072a5ab35e009b5d
MD5 e539ddbc27939a63964ff9836e992d08
SHA1 34951dba9a18e6725d2161e9ed01e3e3a00beaf7
SHA512 a09b336148eb4143c482c6b649287e69a2692afeffcd1d1015176983f697e9c4289f7a57c78c143303ea5200b4ef13ad010a3a5e48a10966bdf2873dba968bb0
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi4:IeklMMYJhqezw/pXzH9i4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2080-25-0x00000000759F0000-0x0000000075B4D000-memory.dmp

Download

memory/2080-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2080-51-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2080-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-54-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2492-53-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2492-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/2492-2-0x00000000759F0000-0x0000000075B4D000-memory.dmp

Download

memory/2492-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2492-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3468-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3468-13-0x00000000759F0000-0x0000000075B4D000-memory.dmp

Download

memory/3468-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3468-66-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4112-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4112-42-0x00000000759F0000-0x0000000075B4D000-memory.dmp

Download

memory/4744-36-0x00000000759F0000-0x0000000075B4D000-memory.dmp

Download

memory/4744-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download