Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 22:52
Static task
static1
Behavioral task
behavioral1
Sample
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe
-
Size
66KB
-
MD5
8dd2b1e33f02ca6eeb0f93757e194ce0
-
SHA1
3d99a59556a2271f75c94dab434c4b86fdf112a1
-
SHA256
b94ba828a6c0b387882445f2bc344a339e1a55c031e173643462f4a95075144f
-
SHA512
a1856ba512a12e0729fad4400ae6823743da9a46d1fbaafe5b2697975fc4e48a947ed5f686888d5c3a5fede963257c6d07e795e5dfab00805d4c3bdcf65fc529
-
SSDEEP
1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiT:IeklMMYJhqezw/pXzH9iT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2672 explorer.exe 1060 spoolsv.exe 3984 svchost.exe 1852 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Drops file in Windows directory 6 IoCs
Processes:
explorer.exespoolsv.exesvchost.exe8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exedescription ioc process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exesvchost.exepid process 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe 2672 explorer.exe 3984 svchost.exe 3984 svchost.exe 3984 svchost.exe 2672 explorer.exe 2672 explorer.exe 2672 explorer.exe 3984 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2672 explorer.exe 3984 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe 2672 explorer.exe 2672 explorer.exe 1060 spoolsv.exe 1060 spoolsv.exe 3984 svchost.exe 3984 svchost.exe 1852 spoolsv.exe 1852 spoolsv.exe 2672 explorer.exe 2672 explorer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 1680 wrote to memory of 2672 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 1680 wrote to memory of 2672 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 1680 wrote to memory of 2672 1680 8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe explorer.exe PID 2672 wrote to memory of 1060 2672 explorer.exe spoolsv.exe PID 2672 wrote to memory of 1060 2672 explorer.exe spoolsv.exe PID 2672 wrote to memory of 1060 2672 explorer.exe spoolsv.exe PID 1060 wrote to memory of 3984 1060 spoolsv.exe svchost.exe PID 1060 wrote to memory of 3984 1060 spoolsv.exe svchost.exe PID 1060 wrote to memory of 3984 1060 spoolsv.exe svchost.exe PID 3984 wrote to memory of 1852 3984 svchost.exe spoolsv.exe PID 3984 wrote to memory of 1852 3984 svchost.exe spoolsv.exe PID 3984 wrote to memory of 1852 3984 svchost.exe spoolsv.exe PID 3984 wrote to memory of 3904 3984 svchost.exe at.exe PID 3984 wrote to memory of 3904 3984 svchost.exe at.exe PID 3984 wrote to memory of 3904 3984 svchost.exe at.exe PID 3984 wrote to memory of 4860 3984 svchost.exe at.exe PID 3984 wrote to memory of 4860 3984 svchost.exe at.exe PID 3984 wrote to memory of 4860 3984 svchost.exe at.exe PID 3984 wrote to memory of 2280 3984 svchost.exe at.exe PID 3984 wrote to memory of 2280 3984 svchost.exe at.exe PID 3984 wrote to memory of 2280 3984 svchost.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8dd2b1e33f02ca6eeb0f93757e194ce0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\at.exeat 22:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
-
C:\Windows\SysWOW64\at.exeat 22:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
-
C:\Windows\SysWOW64\at.exeat 22:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\mrsys.exeFilesize
66KB
MD51432f37ac10ee2e035ea8fba4bec3f00
SHA10f7d5bb644fc084c4df8f1d30ed2eb096441bb6b
SHA2560c1e8f438a89004c5d39540f1837453d24db4264dbdc9ecac53ae9166bae43ab
SHA5122191fd8e6347d9e2fdca50e9c6350ac1df94e9f5a00e0863db3e4480bfd153091bf6a18c258c9271d59f5e6150250610d209354672b1a4e7bb548d187cf058f8
-
C:\Windows\System\explorer.exeFilesize
66KB
MD5eb939894e0a3c62c7b2fb6d27d836dde
SHA136d69cc35a407c66ab834c0da5357ab791284fbd
SHA2562f25f33b47ece38bc0ea6ec3e3875ce730b10a987b59e97fa8d55027be3fd755
SHA512eb2661002bb7d8928323aa98126c2ecbef86a04bb70047909dd78cda120a11c13443bf471dcb97f2c5e6f6ce6057966823a28d19110c371208d7c1242b5aac40
-
C:\Windows\System\spoolsv.exeFilesize
66KB
MD5f7d3abc5c534e5acf1936d1978831989
SHA117402ea1bee30aff6429d5837d7ae3846389f1dd
SHA2562e3681c54f5cdbc14c78c20cfbe77b2f6722cea39c9fdf92d969faa50bc4f118
SHA5125ba664244bc404029eeb08f27d5638bf45811c0128d0f32d1387a390302c077594ba6b1bb69e9b9d8311e2086c09809a1f61a4109c783f91f26c5856179cdad2
-
C:\Windows\System\svchost.exeFilesize
66KB
MD584531e79f82d53112cd42be4cfa2a9d5
SHA1e9d5c8ea15c9231a34a9626306979ebe86f5b70d
SHA256e0aef42db09f8029640b11af023181e801e391414d41c32207860bfb2dc9e576
SHA512e4e829768a497cd9c84df474c6bfdc182e10d70f2a5ffbac44d024cd5c80fa1f8d9d0d162b9b23d5449f569a766add49b6a87a49228f995fd06e683c7a1ada7d
-
\??\PIPE\atsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1060-53-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1060-25-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1060-31-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1060-26-0x0000000075AB0000-0x0000000075C0D000-memory.dmpFilesize
1.4MB
-
memory/1680-3-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1680-56-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1680-0-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1680-4-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1680-2-0x0000000075AB0000-0x0000000075C0D000-memory.dmpFilesize
1.4MB
-
memory/1680-55-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1680-1-0x00000000001C0000-0x00000000001C4000-memory.dmpFilesize
16KB
-
memory/1852-44-0x0000000075AB0000-0x0000000075C0D000-memory.dmpFilesize
1.4MB
-
memory/1852-43-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1852-52-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2672-58-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2672-14-0x0000000075AB0000-0x0000000075C0D000-memory.dmpFilesize
1.4MB
-
memory/2672-16-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2672-69-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2672-13-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/3984-37-0x0000000075AB0000-0x0000000075C0D000-memory.dmpFilesize
1.4MB
-
memory/3984-60-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB