Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
12/06/2024, 22:55
General
- Target 4ad00085fdaf8ca061f774cdae137520_NeikiAnalytics.exe
- Size 212KB
- Sample240612-2wjjmatfrd
- SHA256 15f80a7d63cc3fccc201d33d2bcde1f812de257300df830b41c78712d5154357
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ad00085fdaf8ca061f774cdae137520_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ad00085fdaf8ca061f774cdae137520_NeikiAnalytics.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
login[2].htm
48A4.tmp
48A4.tmp
5C3C.tmp
5C3C.tmp
D20E.tmp
svchost.exe
memory/1076-50-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-46-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-22-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-20-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-40-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-54-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-79-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-77-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-76-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-75-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-74-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-73-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-72-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-70-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-69-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-68-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-67-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-66-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-65-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-64-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-63-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-62-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-61-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-60-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-59-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-58-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-56-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-55-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-53-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-52-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-51-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-19-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1076-49-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-45-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-24-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-47-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-48-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-44-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-43-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-42-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-41-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-39-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-37-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-36-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-35-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-34-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-33-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-32-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-31-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-30-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-28-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-27-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-26-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-78-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-71-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-57-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-38-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-29-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-25-0x00000000032F0000-0x00000000033A6000-memory.dmp
memory/1076-15-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1076-16-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1076-18-0x0000000003140000-0x00000000031E8000-memory.dmp
memory/1076-17-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1396-0-0x0000000000400000-0x00000000005B8000-memory.dmp
memory/1396-1-0x0000000002360000-0x00000000023B1000-memory.dmp
memory/1396-2-0x0000000000400000-0x000000000045F000-memory.dmp
memory/1396-13-0x0000000002360000-0x00000000023B1000-memory.dmp
memory/1396-14-0x0000000000400000-0x000000000045F000-memory.dmp
memory/1396-11-0x0000000000400000-0x00000000005B8000-memory.dmp