Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 21:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4724c3c6a175b97434f210fd143dc410_NeikiAnalytics.dll
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4724c3c6a175b97434f210fd143dc410_NeikiAnalytics.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
4724c3c6a175b97434f210fd143dc410_NeikiAnalytics.dll
-
Size
72KB
-
MD5
4724c3c6a175b97434f210fd143dc410
-
SHA1
ff635ce1d6a2c04be363c7636ecc5e374f06ada9
-
SHA256
a5fad5c2a9c075dadf898770198a86c18468863fbdf28235e01308076af86c61
-
SHA512
2fea1488cdc44eaba6b755b91215488106ef14ad89ed78307fa05cfb560739185cd5372e944a2abadfee21c31c1301372a3fb221f756967bb0fbf70c293915d9
-
SSDEEP
1536:ymJ6BS7LL1X+o9yHSmj9yjdMGHb4c9PWJZ:yLBon1XJyHSI9idMYllWD
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2240 hrl193B.tmp 2352 refzsk.exe -
Loads dropped DLL 2 IoCs
pid Process 1944 rundll32.exe 1944 rundll32.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\refzsk.exe hrl193B.tmp File opened for modification C:\Windows\SysWOW64\refzsk.exe hrl193B.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2240 hrl193B.tmp 2352 refzsk.exe -
Suspicious behavior: MapViewOfSection 47 IoCs
pid Process 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2240 hrl193B.tmp 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe 2352 refzsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2240 hrl193B.tmp Token: SeDebugPrivilege 2352 refzsk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1284 wrote to memory of 1944 1284 rundll32.exe 28 PID 1944 wrote to memory of 2240 1944 rundll32.exe 29 PID 1944 wrote to memory of 2240 1944 rundll32.exe 29 PID 1944 wrote to memory of 2240 1944 rundll32.exe 29 PID 1944 wrote to memory of 2240 1944 rundll32.exe 29 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 384 2240 hrl193B.tmp 3 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 392 2240 hrl193B.tmp 4 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 432 2240 hrl193B.tmp 5 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 476 2240 hrl193B.tmp 6 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 492 2240 hrl193B.tmp 7 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 500 2240 hrl193B.tmp 8 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 596 2240 hrl193B.tmp 9 PID 2240 wrote to memory of 676 2240 hrl193B.tmp 10 PID 2240 wrote to memory of 676 2240 hrl193B.tmp 10 PID 2240 wrote to memory of 676 2240 hrl193B.tmp 10 PID 2240 wrote to memory of 676 2240 hrl193B.tmp 10
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1532
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:744
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:844
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:964
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:108
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1064
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1112
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1976
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2020
-
-
C:\Windows\SysWOW64\refzsk.exeC:\Windows\SysWOW64\refzsk.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4724c3c6a175b97434f210fd143dc410_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4724c3c6a175b97434f210fd143dc410_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\hrl193B.tmpC:\Users\Admin\AppData\Local\Temp\hrl193B.tmp4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5c03d8da864e307bf1691457c9e7dc98d
SHA1f96f442b2438da602feb4e2b4adaada7bbc5e408
SHA256642ba0bd9b2956e19887868f87c9d96ef83bb386de733857f67cf049d3f50d51
SHA512afd7d07f971e92b1079b8a039e6b75f8b68e1b711a384a309a7e7a6e90e3c448dce0118a9847c325fdedfcea84316d0c4d23c471ecc4cd949a5619dc7a677cb6