Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe
- Size 5.8MB
- Sample240612-147qrasena
- SHA256 0a02d24565fa45d6148e7f486524622e5aaef76c1c7f12f19a02b9e8dc88ff0a
- MD5 487c4023424fbda28112c6b847c44e40
- SHA1 9aa8ec70f53402e0e7cb83b0dd9f8d7f7a440266
- SHA512 dc0d9d69390a078eec9bfe2ce36abe7d18cd0ee0330fbb7c3ad37ffb300202d5bd147e6ff2ee2573a28bc87a481a38d542a16ea9e429eb0c2d452615aace985d
- SSDEEP 98304:BOeTRppqj4KGYVAzP4Kq18frP3wbzWFimaI7dloBnL:Qe3pq4KDAgbzWFimaI7dli
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies AppInit DLL entries 2 TTPs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00090000000233fd-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Loads dropped DLL 6 IoCs
pid Process 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 4384 regsvr32.exe 3764 regsvr32.exe 3508 regsvr32.exe 316 regsvr32.exe 728 regsvr32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x00090000000233fd-1.dat upx behavioral2/memory/1076-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4384-11-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/4384-13-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1076-15-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1076-52-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3508-64-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3764-63-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3508-66-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/316-68-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/728-71-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/728-73-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1076-105-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1076-137-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/1076-173-0x0000000010000000-0x0000000010030000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe /onboot" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Low Rights 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "163" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings firefox.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Token: SeRestorePrivilege 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe Token: SeDebugPrivilege 4384 regsvr32.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 3764 regsvr32.exe Token: SeDebugPrivilege 3508 regsvr32.exe Token: SeDebugPrivilege 316 regsvr32.exe Token: SeDebugPrivilege 728 regsvr32.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe Token: SeDebugPrivilege 4484 firefox.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4484 firefox.exe 4484 firefox.exe 4484 firefox.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 4484 firefox.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1076 wrote to memory of 4384 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 84 PID 1076 wrote to memory of 4384 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 84 PID 1076 wrote to memory of 4384 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 84 PID 1076 wrote to memory of 2564 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 85 PID 1076 wrote to memory of 2564 1076 487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe 85 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 2564 wrote to memory of 4484 2564 firefox.exe 86 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 3156 4484 firefox.exe 87 PID 4484 wrote to memory of 1904 4484 firefox.exe 88 PID 4484 wrote to memory of 1904 4484 firefox.exe 88 PID 4484 wrote to memory of 1904 4484 firefox.exe 88 PID 4484 wrote to memory of 1904 4484 firefox.exe 88 PID 4484 wrote to memory of 1904 4484 firefox.exe 88 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\487c4023424fbda28112c6b847c44e40_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.0.2010755856\1157038393" -parentBuildID 20230214051806 -prefsHandle 1764 -prefMapHandle 1756 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9db68ef-25f7-48a7-ab4a-b51bd3880010} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 1852 298235f5758 gpu4⤵PID:3156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.1.82619476\2146707657" -parentBuildID 20230214051806 -prefsHandle 2416 -prefMapHandle 2404 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7953df1-2ecf-402d-8f6c-90718103c9a6} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 2444 2981788ab58 socket4⤵PID:1904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.2.1056690775\607452388" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2976 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45daec9b-a0a1-485e-a357-4dc55518c840} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 2992 2982735cb58 tab4⤵PID:2104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.3.963184564\1486673757" -childID 2 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e831853b-8388-4af0-8b7f-55fdfe81af86} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 3652 29817883258 tab4⤵PID:4608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.4.1663597509\1588548478" -childID 3 -isForBrowser -prefsHandle 5008 -prefMapHandle 5004 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56fe90e7-48fe-44c2-8757-4c04addc0cb0} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 5020 2982a3cc758 tab4⤵PID:3276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.5.346682391\1222489041" -childID 4 -isForBrowser -prefsHandle 5168 -prefMapHandle 5176 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fe0e477-6f00-496b-8c80-04173e659752} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 5160 2982a3ce858 tab4⤵PID:2256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4484.6.1329024249\1351831719" -childID 5 -isForBrowser -prefsHandle 5332 -prefMapHandle 5360 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1232 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acb57b0c-bcf1-4568-a297-f6f00a72cf14} 4484 "\\.\pipe\gecko-crash-server-pipe.4484" 5352 2982a3cdc58 tab4⤵PID:4580
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:728
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\activity-stream.discovery_stream.json.tmp
- Size 23KB
- SHA256 a1aa18b652be8cb966a9f84415ae7a88046c28c13924d6d69f42a345ddf02e8e
- MD5 a8c3628f4469a920bdc9b441ffdab476
- SHA1 8de5ab7c56db8144808dddd84f9a87796de80845
- SHA512 c2e7ded97f2d0217bc7c4afb115fb863a183eb31a449d3ca353f4b0a52c5d39e17d087c7e2e161a4b509d8a0be64718f8e8d8793ea829af8b91a946b552370ac
- SSDEEP 384:rd07ZMLEz/SnkqQGuJIYkFGhoJPVcjOJKR/SbS1zE/5aMCPkbSM5e+yaa:rd+Z1/Sn4QFs1/4+owx8b7y1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js
- Size 7KB
- SHA256 ac814ea64efdaa87f3ae98df12ec4568c6ed065254f8642e7d99afcd35d7fa0b
- MD5 046bf06dc89470185fe23cb22316d30e
- SHA1 86083f1af7d605dde1bd9eda1815d259d8d1eb01
- SHA512 94a213e81ceddebc1d6bcdcbbd4bcae78539d2f2940a9eb567f2675aa385b4fc3eb7d32603a268f9ddeb52aa8e13f732228be0e422ee74275f71a44d8b517a23
- SSDEEP 192:5HnrRKfl+x10Xb2g+3IYSm9xzoyBw8HchSo:K52g4IYSisAwXf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 99297f11d90100818ab00ca29296c84ce5db769a93c10982199264b7d200bc8f
- MD5 10dcfe835b4169267050cc35a4705ff9
- SHA1 23fe88c5da70a6806f853c39817b181900e8f47f
- SHA512 7e28b6209129dc6188be8ff862fc35133f833f8df253e90438d00642ae63db77d02939f5bfe1f9efbe2c992de3e868a1ae2c7f3bf6b812592b1175fc3ef48afd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
- Size 1KB
- SHA256 193a3aece69fd0377d6fc22997e2e1772caf48b02b39aa95e4f76649a684a59c
- MD5 8759c6d4de57597c705af6382221417c
- SHA1 d027a48a0b4f82ecc60874f653434f6756682029
- SHA512 9d9e8ba474253aa3154a95dcd1407924151238a85bb29fc81925aed11a7859746becad2c8b668b6d7bb51048073e183d9463ba37afbcea95190635c123fbecd8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 192KB
- SHA256 bf9092bb963ee7b93317881fd3bbe3471aba96ec3a891659c350c966532a7163
- MD5 6a2f2dffb9e65e1b265878b9e8dc044d
- SHA1 50771197e2d72a56cf37881efcf2118763462ad6
- SHA512 0de7282d4c61afe658b4ed1e8be38c69305c352409db6802620872f7a4ab3fcf51bd89ef752afef488aa7e7bbde94369cb0b2e46ee127c205d468be6e0f38ca4
- SSDEEP 3072:U1cHrylP83y3rD2paN6s0bEeH5K+Lxj8r7r8:U1cHrylP83y3rDkaN6ssEeHBLY7r8
- MD5 SHA1 SHA512 SSDEEP