Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 21:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02e4e0e84719fa7fab4d7edd7e9f1550_NeikiAnalytics.dll
Resource
win7-20240508-en
windows7-x64
15 signatures
150 seconds
General
-
Target
02e4e0e84719fa7fab4d7edd7e9f1550_NeikiAnalytics.dll
-
Size
120KB
-
MD5
02e4e0e84719fa7fab4d7edd7e9f1550
-
SHA1
9bb5f2dbefe26aac9722a94053d73dd031928dd9
-
SHA256
1cb5393556b16bb379736e490a060fae90a160a12f530a01c6b60d4582f4b65b
-
SHA512
cf35d0fee50b84d00ca0cf69ef3fe9c1868439c7457fc18c0aa7a34f6e57863a6ceb44c6b33528f9a36c4ae37cdd2c2a0aed64016bf0b7b6040e0ff5c322dacb
-
SSDEEP
1536:MNUF5bAAqvGrFZXBMk4Joc9LcXZqdIhYD6DzsmLNEsPlEA5jSWqkEM3:aWxAf+PDX1YD63h+alEAsdkE
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76122a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76122a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762dc4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762dc4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762dc4.exe -
Executes dropped EXE 3 IoCs
pid Process 2268 f76122a.exe 2756 f7613a0.exe 1352 f762dc4.exe -
Loads dropped DLL 6 IoCs
pid Process 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe 1732 rundll32.exe -
resource yara_rule behavioral1/memory/2268-17-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-12-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-16-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-14-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-18-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-20-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-22-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-15-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-21-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-19-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-65-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-64-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-66-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-67-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-68-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-70-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-71-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-86-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-87-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-89-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-126-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2268-152-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1352-171-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx behavioral1/memory/1352-206-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76122a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762dc4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762dc4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76122a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762dc4.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: f76122a.exe File opened (read-only) \??\E: f762dc4.exe File opened (read-only) \??\K: f76122a.exe File opened (read-only) \??\M: f76122a.exe File opened (read-only) \??\H: f76122a.exe File opened (read-only) \??\I: f76122a.exe File opened (read-only) \??\L: f76122a.exe File opened (read-only) \??\P: f76122a.exe File opened (read-only) \??\Q: f76122a.exe File opened (read-only) \??\R: f76122a.exe File opened (read-only) \??\G: f762dc4.exe File opened (read-only) \??\G: f76122a.exe File opened (read-only) \??\J: f76122a.exe File opened (read-only) \??\N: f76122a.exe File opened (read-only) \??\O: f76122a.exe File opened (read-only) \??\T: f76122a.exe File opened (read-only) \??\E: f76122a.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f761297 f76122a.exe File opened for modification C:\Windows\SYSTEM.INI f76122a.exe File created C:\Windows\f76629a f762dc4.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2268 f76122a.exe 2268 f76122a.exe 1352 f762dc4.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 2268 f76122a.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe Token: SeDebugPrivilege 1352 f762dc4.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 348 wrote to memory of 1732 348 rundll32.exe 28 PID 1732 wrote to memory of 2268 1732 rundll32.exe 29 PID 1732 wrote to memory of 2268 1732 rundll32.exe 29 PID 1732 wrote to memory of 2268 1732 rundll32.exe 29 PID 1732 wrote to memory of 2268 1732 rundll32.exe 29 PID 2268 wrote to memory of 1052 2268 f76122a.exe 17 PID 2268 wrote to memory of 1124 2268 f76122a.exe 19 PID 2268 wrote to memory of 1180 2268 f76122a.exe 21 PID 2268 wrote to memory of 1740 2268 f76122a.exe 23 PID 2268 wrote to memory of 348 2268 f76122a.exe 27 PID 2268 wrote to memory of 1732 2268 f76122a.exe 28 PID 2268 wrote to memory of 1732 2268 f76122a.exe 28 PID 1732 wrote to memory of 2756 1732 rundll32.exe 30 PID 1732 wrote to memory of 2756 1732 rundll32.exe 30 PID 1732 wrote to memory of 2756 1732 rundll32.exe 30 PID 1732 wrote to memory of 2756 1732 rundll32.exe 30 PID 1732 wrote to memory of 1352 1732 rundll32.exe 31 PID 1732 wrote to memory of 1352 1732 rundll32.exe 31 PID 1732 wrote to memory of 1352 1732 rundll32.exe 31 PID 1732 wrote to memory of 1352 1732 rundll32.exe 31 PID 2268 wrote to memory of 1052 2268 f76122a.exe 17 PID 2268 wrote to memory of 1124 2268 f76122a.exe 19 PID 2268 wrote to memory of 1180 2268 f76122a.exe 21 PID 2268 wrote to memory of 2756 2268 f76122a.exe 30 PID 2268 wrote to memory of 2756 2268 f76122a.exe 30 PID 2268 wrote to memory of 1352 2268 f76122a.exe 31 PID 2268 wrote to memory of 1352 2268 f76122a.exe 31 PID 1352 wrote to memory of 1052 1352 f762dc4.exe 17 PID 1352 wrote to memory of 1124 1352 f762dc4.exe 19 PID 1352 wrote to memory of 1180 1352 f762dc4.exe 21 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76122a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762dc4.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1052
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1124
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02e4e0e84719fa7fab4d7edd7e9f1550_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02e4e0e84719fa7fab4d7edd7e9f1550_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\f76122a.exeC:\Users\Admin\AppData\Local\Temp\f76122a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\f7613a0.exeC:\Users\Admin\AppData\Local\Temp\f7613a0.exe4⤵
- Executes dropped EXE
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\f762dc4.exeC:\Users\Admin\AppData\Local\Temp\f762dc4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1352
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1740
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD546abbc90a74edcb17484102554aa5c93
SHA1c1eb82f303d1ed58028c809ef7c3fd86dcb5926c
SHA2562fe5f590fbc833adfefe33bc0ff0b514e27717022cd978fd336410c6de0a1587
SHA51255574bea7833ba2579ff55034bc3235fddebe36aac0f332a459b4f4aac6f59e1b9204c0660bf38408efd4c1eda25560be953e906ae195f6de50edf1c0d40064c
-
Filesize
97KB
MD5978d1053b903620a373a7b1e298a866c
SHA19fdcfe163304695c7b850dd66103226fe5644185
SHA2565fe010405970b1f7f24ee7a6ac20ca0abe24828434e42ea288ca9938b3d228ed
SHA51266edec6bb585c1c03d788209f80d59735b2782bd918bee2e4ef30bea771b9e68466e772d200ceb83ca20e6f10f2a1577ee2994597528ab9948ed88bc8c5220d9