Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 22:42

General

  • Target

    09c34b1deb789f1fba5a8dabf76b6740_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    09c34b1deb789f1fba5a8dabf76b6740

  • SHA1

    0e1590f2ab4cd4cdcf04988992809c6815bffbda

  • SHA256

    8989a4e9cd5f257653eb4672e5fbd9998552e1f3521c1056ed5b8fc780e60ed8

  • SHA512

    eaf91c1a1fb539d97b587d46b7116e81561275865c981e546248478e983aeb62d42800d7c02e63a5e52b879e99482468e4419e888b932857a925179199e1c44d

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiE:IeklMMYJhqezw/pXzH9iE

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09c34b1deb789f1fba5a8dabf76b6740_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\09c34b1deb789f1fba5a8dabf76b6740_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1792
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2828
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2796
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2792
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2528
          • C:\Windows\SysWOW64\at.exe
            at 22:44 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1828
            • C:\Windows\SysWOW64\at.exe
              at 22:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1772
              • C:\Windows\SysWOW64\at.exe
                at 22:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:376

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\mrsys.exe

                Filesize

                66KB

                MD5

                32526a97653bae527bad9ca58d8a726b

                SHA1

                9c53bb99d6540bc5a086981aae8f5876481d9bd3

                SHA256

                377631dc66c51bcf03ddf834e7018ff1f9240454c6a68658a42b8cf7223869ca

                SHA512

                b4b2c8b56eecfc9cbbe79fc757c8595284068d4af2fc8cd12ce90703a95a99cb93f0604c89707fd8088eb9a42f521d4cecc20924bac85ed7f318a8b955e5431e

              • \Windows\system\explorer.exe

                Filesize

                66KB

                MD5

                f797f5501d9091db3c26d1c03b03d1f0

                SHA1

                e3c5f594f13ce38e7a63f66604a72a51549f2368

                SHA256

                a4445ad6b978e2f16876bd1e293de635ef30d73310388a9499ad17323006cdd8

                SHA512

                60ebb156c3aa57993c5022735a9233323d74de53d8e984a31d4ce5901a2bafdc1ae18039395b87d3e94fd103c79c1591c713827d9c0dc0de5aa9b1b9b01fcee6

              • \Windows\system\spoolsv.exe

                Filesize

                66KB

                MD5

                33ede6bccf9d2258514099d954c7df8f

                SHA1

                1a55de87288cce44199284d575270a4972d111ef

                SHA256

                1629a5a2a8a826d00769b3e227ca0f289cf37ba8646f4533e9f57a28a043a610

                SHA512

                47d545ea453ba1303752b21e2e39188e98d715b3eab2f2693c321a1d0d19f75c9ae06b2172df45d13dbe498e2f81badf592318e9bbf874ff7af6c045789b19e6

              • \Windows\system\svchost.exe

                Filesize

                66KB

                MD5

                d8eb426fba529391001f1c7331a1ddca

                SHA1

                8de3be06160903f020d44be2c35f19886dc383c4

                SHA256

                5dddfc9fd7d6f7fc4ad0812c9e70036a934daed82e4f7c301412f68134d47f40

                SHA512

                e4354e9e993d9390c44c061dbb144276c0455ec931728f2652c6e5dffda261fc121b6f0ba67d865937ad70f0d1550e6e187c30ba925c20cf9c366f6fab3621cb

              • memory/1792-81-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1792-1-0x0000000000020000-0x0000000000024000-memory.dmp

                Filesize

                16KB

              • memory/1792-0-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1792-18-0x0000000002600000-0x0000000002631000-memory.dmp

                Filesize

                196KB

              • memory/1792-17-0x0000000002600000-0x0000000002631000-memory.dmp

                Filesize

                196KB

              • memory/1792-2-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/1792-62-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1792-3-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/1792-82-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/1792-4-0x0000000000401000-0x000000000042E000-memory.dmp

                Filesize

                180KB

              • memory/2528-75-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2528-69-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2528-68-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2792-86-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2792-55-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2792-56-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2792-63-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2796-38-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2796-53-0x0000000001E00000-0x0000000001E31000-memory.dmp

                Filesize

                196KB

              • memory/2796-42-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2796-77-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2828-67-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2828-36-0x00000000024F0000-0x0000000002521000-memory.dmp

                Filesize

                196KB

              • memory/2828-37-0x00000000024F0000-0x0000000002521000-memory.dmp

                Filesize

                196KB

              • memory/2828-20-0x0000000072940000-0x0000000072A93000-memory.dmp

                Filesize

                1.3MB

              • memory/2828-22-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2828-84-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2828-19-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB

              • memory/2828-95-0x0000000000400000-0x0000000000431000-memory.dmp

                Filesize

                196KB