9836e8a1c8b4ae4c74da88cb86a489a9e43d49e75a9e1059726f9cbd0c3edb2d

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
Size 65KB
Sample240613-a6767axgnc
SHA256 9836e8a1c8b4ae4c74da88cb86a489a9e43d49e75a9e1059726f9cbd0c3edb2d
MD5 5175cd282f9f7304d525b068ac6290d0
SHA1 1dfb6cc5773c4ae6bf98f53161e161d72b9afce7
SHA512 cc1b57e240f02981f24bc0d7442a957d14310a0103a7947126ae6360a026ee10d9bd5b504dd65953b0039b90c27f156ff0837218a680e76efea9f82301f531ba
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OupddddddddddddddddddE:7WNqkOJWmo1HpM0MkTUmupdddddddddu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2724	explorer.exe
2804	spoolsv.exe
2924	svchost.exe
2516	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2724	explorer.exe
2724	explorer.exe
2804	spoolsv.exe
2804	spoolsv.exe
2924	svchost.exe
2924	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2724	explorer.exe
2724	explorer.exe
2724	explorer.exe
2724	explorer.exe
2724	explorer.exe
2724	explorer.exe
2924	svchost.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe
2724	explorer.exe
2924	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2724	explorer.exe
2924	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2724	explorer.exe
2724	explorer.exe
2804	spoolsv.exe
2804	spoolsv.exe
2924	svchost.exe
2924	svchost.exe
2516	spoolsv.exe
2516	spoolsv.exe
2724	explorer.exe
2724	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2724	2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 2724	2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 2724	2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	28
PID 2176 wrote to memory of 2724	2176	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	28
PID 2724 wrote to memory of 2804	2724	explorer.exe	29
PID 2724 wrote to memory of 2804	2724	explorer.exe	29
PID 2724 wrote to memory of 2804	2724	explorer.exe	29
PID 2724 wrote to memory of 2804	2724	explorer.exe	29
PID 2804 wrote to memory of 2924	2804	spoolsv.exe	30
PID 2804 wrote to memory of 2924	2804	spoolsv.exe	30
PID 2804 wrote to memory of 2924	2804	spoolsv.exe	30
PID 2804 wrote to memory of 2924	2804	spoolsv.exe	30
PID 2924 wrote to memory of 2516	2924	svchost.exe	31
PID 2924 wrote to memory of 2516	2924	svchost.exe	31
PID 2924 wrote to memory of 2516	2924	svchost.exe	31
PID 2924 wrote to memory of 2516	2924	svchost.exe	31
PID 2924 wrote to memory of 684	2924	svchost.exe	32
PID 2924 wrote to memory of 684	2924	svchost.exe	32
PID 2924 wrote to memory of 684	2924	svchost.exe	32
PID 2924 wrote to memory of 684	2924	svchost.exe	32
PID 2924 wrote to memory of 2460	2924	svchost.exe	36
PID 2924 wrote to memory of 2460	2924	svchost.exe	36
PID 2924 wrote to memory of 2460	2924	svchost.exe	36
PID 2924 wrote to memory of 2460	2924	svchost.exe	36
PID 2924 wrote to memory of 2296	2924	svchost.exe	38
PID 2924 wrote to memory of 2296	2924	svchost.exe	38
PID 2924 wrote to memory of 2296	2924	svchost.exe	38
PID 2924 wrote to memory of 2296	2924	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:684
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2460
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 f8dc9290118cb127c3b135b275c650e350961a16ad4867558e68d03db4cff68c
MD5 c3e4d50a19bda9572ebdf40607d3c693
SHA1 331030c76b2eb100d3be7b2a00c61fb184eaf4a4
SHA512 029cdf74bce9f00765bdc66be4fe99b4066a0bdc905707156b8656d8138e09f637b55351011f13956af9df58747fd561fa13132f3cca3c363ac75a9eaa427259
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oun:7WNqkOJWmo1HpM0MkTUmun
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \Windows\system\explorer.exe
Size 65KB
SHA256 1a3ad99a2e97e762978533b7fd5bcee8d8882c92fd7ba459c55af546e218b1c6
MD5 8af4a124c0c5016030f49046238cdbee
SHA1 6dd84beb5d16e5670de5482001995186414c5dc5
SHA512 4225193f80efb512321069818a1d14ef240a7e7f4b96e9aa5bde5d64253701162b687469df0fe2aa7ad3eafeedf2f4bf7eb1004c668db6985096c3581e5ac4f7
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oui:7WNqkOJWmo1HpM0MkTUmui
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \Windows\system\spoolsv.exe
Size 65KB
SHA256 10218b3ad8943af9e2dc6a7c11aa4991cfdefde9d5d4c0e122ad26545466ed09
MD5 8cc2b3440135c627e00c82bd97102e27
SHA1 5d603309876130d8d30c7348a6c03f825645d664
SHA512 7d33c4a570e235b5a03df49602a94c83c5b134e10e5117cc82f670125346233c455edf60d059b8c06cab6161bf923e4df1875efb9db2690766ae3afaeefa6f94
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuI:7WNqkOJWmo1HpM0MkTUmuI
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\system\svchost.exe
Size 65KB
SHA256 bde7e296f62444444c5b9250acd16f3a14ba931ea54b4539e8f711026cca500a
MD5 f9a169a8450d96541d63cc71200c3102
SHA1 7a6f884a5849efa282323487680803cb9c18e34c
SHA512 985f91e0849100223cf96956acced72963ea8568869e75edbfaceea1ef0c8b0f9c38a308c8179bdd83ce8634272cc54e0765730c08acf22e042b56e56cbfc6b5
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oup:7WNqkOJWmo1HpM0MkTUmup
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2176-18-0x0000000002B90000-0x0000000002BC1000-memory.dmp

Download

memory/2176-54-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/2176-12-0x0000000002B90000-0x0000000002BC1000-memory.dmp

Download

memory/2176-1-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/2176-80-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2176-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2176-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2176-79-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2176-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2176-60-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2176-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2516-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2516-74-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2724-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2724-83-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2724-82-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2724-94-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2724-35-0x0000000002700000-0x0000000002731000-memory.dmp

Download

memory/2724-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2724-19-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2804-37-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2804-78-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2804-58-0x0000000002610000-0x0000000002641000-memory.dmp

Download

memory/2804-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2804-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2924-67-0x0000000002B50000-0x0000000002B81000-memory.dmp

Download

memory/2924-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2924-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2924-85-0x0000000000400000-0x0000000000431000-memory.dmp

Download