ac142a0fb80e50e856e020a3a5f30ec31bb95114b91d75878ed1ff1307d080fb

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2449161e8fa06ccd0b6519d6ff761820_NeikiAnalytics.dll
Size

500KB
MD5

2449161e8fa06ccd0b6519d6ff761820
SHA1

55a8ed75679a79175ab528e93912e0e39aa7b044
SHA256

ac142a0fb80e50e856e020a3a5f30ec31bb95114b91d75878ed1ff1307d080fb
SHA512

a8cf2bc1dddfe35b00477a41fca6b822aa6aded77c38b122e5bbc2ec1a6274eba96183dfd26a6b42ae5190eb06346313b8ef0cd79d64c4795f396217aad962a4
SSDEEP

6144:Mi05kH9OyU2uv5SRf/FWgFgt0gqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:nrHGPv5SmptZDmUWuVZkxikdXcq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1264	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ytaumll = "\"C:\\Users\\Admin\\AppData\\Roaming\\mzIhPC\\Netplwiz.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\1629\credwiz.exe	cmd.exe
File opened for modification	C:\Windows\system32\1629\credwiz.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2628	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell\open	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\qmp5M.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\MSCFile\shell\open	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2352	rundll32.exe
2352	rundll32.exe
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found
1264	Process not Found

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2796	1264	Process not Found	28
PID 1264 wrote to memory of 2796	1264	Process not Found	28
PID 1264 wrote to memory of 2796	1264	Process not Found	28
PID 1264 wrote to memory of 2736	1264	Process not Found	29
PID 1264 wrote to memory of 2736	1264	Process not Found	29
PID 1264 wrote to memory of 2736	1264	Process not Found	29
PID 1264 wrote to memory of 1156	1264	Process not Found	31
PID 1264 wrote to memory of 1156	1264	Process not Found	31
PID 1264 wrote to memory of 1156	1264	Process not Found	31
PID 1156 wrote to memory of 1220	1156	cmd.exe	33
PID 1156 wrote to memory of 1220	1156	cmd.exe	33
PID 1156 wrote to memory of 1220	1156	cmd.exe	33
PID 1264 wrote to memory of 2608	1264	Process not Found	34
PID 1264 wrote to memory of 2608	1264	Process not Found	34
PID 1264 wrote to memory of 2608	1264	Process not Found	34
PID 1264 wrote to memory of 2812	1264	Process not Found	35
PID 1264 wrote to memory of 2812	1264	Process not Found	35
PID 1264 wrote to memory of 2812	1264	Process not Found	35
PID 1264 wrote to memory of 2052	1264	Process not Found	36
PID 1264 wrote to memory of 2052	1264	Process not Found	36
PID 1264 wrote to memory of 2052	1264	Process not Found	36
PID 1264 wrote to memory of 2488	1264	Process not Found	37
PID 1264 wrote to memory of 2488	1264	Process not Found	37
PID 1264 wrote to memory of 2488	1264	Process not Found	37
PID 1264 wrote to memory of 2060	1264	Process not Found	38
PID 1264 wrote to memory of 2060	1264	Process not Found	38
PID 1264 wrote to memory of 2060	1264	Process not Found	38
PID 1264 wrote to memory of 2092	1264	Process not Found	39
PID 1264 wrote to memory of 2092	1264	Process not Found	39
PID 1264 wrote to memory of 2092	1264	Process not Found	39
PID 1264 wrote to memory of 1700	1264	Process not Found	41
PID 1264 wrote to memory of 1700	1264	Process not Found	41
PID 1264 wrote to memory of 1700	1264	Process not Found	41
PID 1700 wrote to memory of 1768	1700	eventvwr.exe	42
PID 1700 wrote to memory of 1768	1700	eventvwr.exe	42
PID 1700 wrote to memory of 1768	1700	eventvwr.exe	42
PID 1768 wrote to memory of 2628	1768	cmd.exe	44
PID 1768 wrote to memory of 2628	1768	cmd.exe	44
PID 1768 wrote to memory of 2628	1768	cmd.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2449161e8fa06ccd0b6519d6ff761820_NeikiAnalytics.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2352

C:\Windows\system32\Netplwiz.exe
C:\Windows\system32\Netplwiz.exe
1⤵
PID:2796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ib65e2.cmd
1⤵
PID:2736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{4a94cc21-ab5c-b52d-bcf4-6eb5b4fdcb9a}"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{4a94cc21-ab5c-b52d-bcf4-6eb5b4fdcb9a}"
  2⤵
  PID:1220

C:\Windows\system32\charmap.exe
C:\Windows\system32\charmap.exe
1⤵
PID:2608

C:\Windows\system32\cleanmgr.exe
C:\Windows\system32\cleanmgr.exe
1⤵
PID:2812

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe
1⤵
PID:2052

C:\Windows\system32\secinit.exe
C:\Windows\system32\secinit.exe
1⤵
PID:2488

C:\Windows\system32\credwiz.exe
C:\Windows\system32\credwiz.exe
1⤵
PID:2060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\sxQ.cmd
1⤵
- Drops file in System32 directory
PID:2092

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\qmp5M.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Iqeyjqzalasn" /SC minute /MO 60 /TR "C:\Windows\system32\1629\credwiz.exe" /RL highest
    3⤵
    - Creates scheduled task(s)
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wl22AE.tmp

Filesize
504KB

MD5
ee34d24776ae2dfbf727a1d4958d2d70

SHA1
f3722a5ec505891b1a158b642c99a843deffd4c4

SHA256
aed499135f47b62de9fea1f0cac2d0268180b95c5eaab77f149c1e5f8f3ce460

SHA512
d5c0c8bb03c40b5be9915d5e3f2d21389333d5dee56a1cd1b2d15083d46a1adc88921f028f7eedf68d56d64ac925b38031bcb12c1b2497752e6d83a1e183cfe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ib65e2.cmd

Filesize
234B

MD5
d046c93db006050fcd50d4e3441d845b

SHA1
6947c1cf16cb5e05121c6549f5dbed54efa2505c

SHA256
77f9c820eb62cf50cb720509c42a00cfe2d5273dfb10f6370e799031a57fa6d5

SHA512
a6c70b7e15f2c40f79ef518c6ac950b1d5faff74cc3f09349a750790d326d3998a037fb777969c3d0e53241303b947b389bbe73c5afe4a90e2c8cb16b27b1531

Download Submit
C:\Users\Admin\AppData\Local\Temp\qmp5M.cmd

Filesize
130B

MD5
3ec52fa60983a2a5c5e160f3191d414a

SHA1
248f66246943664ebe1d9c2e22f0e83e5c08e465

SHA256
5ac256029e88fed324907a9b70abaf82dd15d9c13c143f091c5c2bec95e1602d

SHA512
ed2169d5313c596e7da16ce33fbe6837b17095144fd3341d2ee42b3eac67641c423eec8839cc9754e4c1261af00ce6cefdff46241eb95c73a3c940900184ed19

Download Submit
C:\Users\Admin\AppData\Local\Temp\rG2185.tmp

Filesize
500KB

MD5
b423890849ecea08103b48434846ddbf

SHA1
e16c3ef08f670ab8b27076f70ecb5c9c015e7959

SHA256
7f483759e3954b7f70d67dfc9dbdd8db7f5a494fe77522ac0ea1765609b6ef1a

SHA512
0bd7b5c4d674deb6a3aea043ee64c977f0680d9ce4698b74a8af8db7b2ae43055f828baf6639a7951b41ded4f775f11bb44efa67de071fdf3e8da89d9f5a041f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxQ.cmd

Filesize
194B

MD5
5d10374ed414ebf0c99155c9438a473c

SHA1
7da06c4d30f8bf4c15bd409e2cb9f76ff1946373

SHA256
9ebdc873a163c44a75ca24203248728a643849846dc842c6bca2e53674e40988

SHA512
b6fb5d5a445cb80e7b860667e13eaa237fbeaece7772f546d4a3ae9b208361f357d4500d1f15a7328bb7e6dd6b25d4f92ed7a6adf2884ee21a43a8842c5f3b88

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ytaumll.lnk

Filesize
886B

MD5
3c19c66a5ffc2055471dcd5542f0b1f5

SHA1
b762ffe59468c57727ad76ac971e1db34aa55f32

SHA256
58db180c02374be0f0a2fcc830d552798e71e6ec224daf4a65896420a6ec940e

SHA512
d1d0707f43343636fa86dfc39394011f55663f579865ee4ce2ce8a9680cff0291a2f4a2c12f46c555ba4390a8d006e38774fde6f2f9d79e3381466ae8edd16a0

Download Submit
C:\Users\Admin\AppData\Roaming\mzIhPC\Netplwiz.exe

Filesize
26KB

MD5
e43ec3c800d4c0716613392e81fba1d9

SHA1
37de6a235e978ecf3bb0fc2c864016c5b0134348

SHA256
636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c

SHA512
176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

Download Submit
memory/1264-26-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-20-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-10-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-12-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-13-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-14-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-11-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-18-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-21-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-28-0x0000000002520000-0x0000000002527000-memory.dmp

Filesize
28KB

Download
memory/1264-38-0x00000000774D1000-0x00000000774D2000-memory.dmp

Filesize
4KB

Download
memory/1264-35-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-27-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-100-0x00000000773C6000-0x00000000773C7000-memory.dmp

Filesize
4KB

Download
memory/1264-25-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-24-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-22-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-23-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-19-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-17-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-16-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-15-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-45-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-48-0x0000000077630000-0x0000000077632000-memory.dmp

Filesize
8KB

Download
memory/1264-49-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-50-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-9-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-8-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-7-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/1264-3-0x00000000773C6000-0x00000000773C7000-memory.dmp

Filesize
4KB

Download
memory/1264-4-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2352-6-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download
memory/2352-2-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2352-0-0x0000000140000000-0x000000014007D000-memory.dmp

Filesize
500KB

Download