Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 22:52
Static task
static1
Behavioral task
behavioral1
Sample
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe
-
Size
66KB
-
MD5
8dd2b1e33f02ca6eeb0f93757e194ce0
-
SHA1
3d99a59556a2271f75c94dab434c4b86fdf112a1
-
SHA256
b94ba828a6c0b387882445f2bc344a339e1a55c031e173643462f4a95075144f
-
SHA512
a1856ba512a12e0729fad4400ae6823743da9a46d1fbaafe5b2697975fc4e48a947ed5f686888d5c3a5fede963257c6d07e795e5dfab00805d4c3bdcf65fc529
-
SSDEEP
1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiT:IeklMMYJhqezw/pXzH9iT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 3060 explorer.exe 2568 spoolsv.exe 2340 svchost.exe 2572 spoolsv.exe -
Loads dropped DLL 8 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exepid process 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 3060 explorer.exe 3060 explorer.exe 2568 spoolsv.exe 2568 spoolsv.exe 2340 svchost.exe 2340 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
Processes:
spoolsv.exeexplorer.exesvchost.exe8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exedescription ioc process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exesvchost.exepid process 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe 2340 svchost.exe 2340 svchost.exe 3060 explorer.exe 2340 svchost.exe 3060 explorer.exe 3060 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 3060 explorer.exe 2340 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 3060 explorer.exe 3060 explorer.exe 2568 spoolsv.exe 2568 spoolsv.exe 2340 svchost.exe 2340 svchost.exe 2572 spoolsv.exe 2572 spoolsv.exe 3060 explorer.exe 3060 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 912 wrote to memory of 3060 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 912 wrote to memory of 3060 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 912 wrote to memory of 3060 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 912 wrote to memory of 3060 912 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 3060 wrote to memory of 2568 3060 explorer.exe spoolsv.exe PID 3060 wrote to memory of 2568 3060 explorer.exe spoolsv.exe PID 3060 wrote to memory of 2568 3060 explorer.exe spoolsv.exe PID 3060 wrote to memory of 2568 3060 explorer.exe spoolsv.exe PID 2568 wrote to memory of 2340 2568 spoolsv.exe svchost.exe PID 2568 wrote to memory of 2340 2568 spoolsv.exe svchost.exe PID 2568 wrote to memory of 2340 2568 spoolsv.exe svchost.exe PID 2568 wrote to memory of 2340 2568 spoolsv.exe svchost.exe PID 2340 wrote to memory of 2572 2340 svchost.exe spoolsv.exe PID 2340 wrote to memory of 2572 2340 svchost.exe spoolsv.exe PID 2340 wrote to memory of 2572 2340 svchost.exe spoolsv.exe PID 2340 wrote to memory of 2572 2340 svchost.exe spoolsv.exe PID 2340 wrote to memory of 1960 2340 svchost.exe at.exe PID 2340 wrote to memory of 1960 2340 svchost.exe at.exe PID 2340 wrote to memory of 1960 2340 svchost.exe at.exe PID 2340 wrote to memory of 1960 2340 svchost.exe at.exe PID 2340 wrote to memory of 2556 2340 svchost.exe at.exe PID 2340 wrote to memory of 2556 2340 svchost.exe at.exe PID 2340 wrote to memory of 2556 2340 svchost.exe at.exe PID 2340 wrote to memory of 2556 2340 svchost.exe at.exe PID 2340 wrote to memory of 1828 2340 svchost.exe at.exe PID 2340 wrote to memory of 1828 2340 svchost.exe at.exe PID 2340 wrote to memory of 1828 2340 svchost.exe at.exe PID 2340 wrote to memory of 1828 2340 svchost.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\at.exeat 22:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
-
C:\Windows\SysWOW64\at.exeat 22:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
-
C:\Windows\SysWOW64\at.exeat 22:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mrsys.exeFilesize
66KB
MD5230e2f4f9c41c8abc57faf124b987134
SHA16e520af9ac42ca78fac317199aa44b4ae5251465
SHA256c3e46f886c7b2d2bdec41d91d32dabcc86b862473b69bf5728516173edddbbdc
SHA512d1114462fd8a465d6a73fd65791806f5729c44ad2b83e19d9b689ab85a11c4046686eb79c6d6b2f3d63fd799c2771bb7a87375d6559469e32c8f48b7916943e1
-
\??\PIPE\atsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\system\explorer.exeFilesize
66KB
MD5bd90939f8c18255710b1bb3ae2e23a1f
SHA1b2569e5da708d05bc8b4c99e7ff2563f8d462e2f
SHA256d75938df7321bef21c6ae2321673a987fd5c355b51a4dcd018ab0cc7ea74a5c6
SHA5127a6c67da278877e3ca5b115e8151d9f41929f147c8c4a77eb6e695ba4f8241c11a60ef1be2550efb5e88a13e6d8f211012c4e9657fb7b468158ca112c73606d7
-
\Windows\system\spoolsv.exeFilesize
66KB
MD546f4583bf985036de76a90f75e4e2d09
SHA183d218b4fe7948d3190fa11f5e5d51d48f143409
SHA2561f111fd63fb3a74e68a447d25aded880d1e2efe30c8534f983e37aea9870b240
SHA5124660db55b25195de0be6c29893b1a8754eb95f2a70fb41fb668681917687eeb02b0fe61a805ced45787b950cf40e3324a209d674c07a419e44a65841e82b31ed
-
\Windows\system\svchost.exeFilesize
66KB
MD5373e070e175a7819b1b5ea6618c0de92
SHA16717ad4e4b9dc496997f79526a04c02ba09d288a
SHA256eb86d6cfa291510c73a5c336b8926032db26891b66ae73466f0d4b88713d08f3
SHA512be83799e27ce42572770f00df938006514af5d258a0d6482d35a641271fd6a37177785063665057e8a416fb28c59f0e626be222ed173764c4128761b775fb44c
-
memory/912-63-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/912-79-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/912-78-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/912-16-0x00000000006F0000-0x0000000000721000-memory.dmpFilesize
196KB
-
memory/912-3-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/912-0-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/912-2-0x0000000072940000-0x0000000072A93000-memory.dmpFilesize
1.3MB
-
memory/912-4-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/912-1-0x0000000000020000-0x0000000000024000-memory.dmpFilesize
16KB
-
memory/2340-52-0x0000000072940000-0x0000000072A93000-memory.dmpFilesize
1.3MB
-
memory/2340-59-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2340-64-0x0000000000390000-0x00000000003C1000-memory.dmpFilesize
196KB
-
memory/2340-57-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2340-83-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2568-41-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2568-36-0x0000000072940000-0x0000000072A93000-memory.dmpFilesize
1.3MB
-
memory/2568-55-0x0000000002620000-0x0000000002651000-memory.dmpFilesize
196KB
-
memory/2568-35-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2568-76-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2572-66-0x0000000072940000-0x0000000072A93000-memory.dmpFilesize
1.3MB
-
memory/2572-72-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3060-34-0x0000000002690000-0x00000000026C1000-memory.dmpFilesize
196KB
-
memory/3060-81-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3060-18-0x0000000072940000-0x0000000072A93000-memory.dmpFilesize
1.3MB
-
memory/3060-92-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3060-20-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB