9836e8a1c8b4ae4c74da88cb86a489a9e43d49e75a9e1059726f9cbd0c3edb2d

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
Size 65KB
Sample240613-a6767axgnc
SHA256 9836e8a1c8b4ae4c74da88cb86a489a9e43d49e75a9e1059726f9cbd0c3edb2d
MD5 5175cd282f9f7304d525b068ac6290d0
SHA1 1dfb6cc5773c4ae6bf98f53161e161d72b9afce7
SHA512 cc1b57e240f02981f24bc0d7442a957d14310a0103a7947126ae6360a026ee10d9bd5b504dd65953b0039b90c27f156ff0837218a680e76efea9f82301f531ba
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OupddddddddddddddddddE:7WNqkOJWmo1HpM0MkTUmupdddddddddu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
4036	explorer.exe
4380	spoolsv.exe
3432	svchost.exe
1836	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe
3432	svchost.exe
3432	svchost.exe
4036	explorer.exe
4036	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4036	explorer.exe
3432	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
4036	explorer.exe
4036	explorer.exe
4380	spoolsv.exe
4380	spoolsv.exe
3432	svchost.exe
3432	svchost.exe
1836	spoolsv.exe
1836	spoolsv.exe
4036	explorer.exe
4036	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4036	2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	92
PID 2412 wrote to memory of 4036	2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	92
PID 2412 wrote to memory of 4036	2412	5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe	92
PID 4036 wrote to memory of 4380	4036	explorer.exe	93
PID 4036 wrote to memory of 4380	4036	explorer.exe	93
PID 4036 wrote to memory of 4380	4036	explorer.exe	93
PID 4380 wrote to memory of 3432	4380	spoolsv.exe	94
PID 4380 wrote to memory of 3432	4380	spoolsv.exe	94
PID 4380 wrote to memory of 3432	4380	spoolsv.exe	94
PID 3432 wrote to memory of 1836	3432	svchost.exe	95
PID 3432 wrote to memory of 1836	3432	svchost.exe	95
PID 3432 wrote to memory of 1836	3432	svchost.exe	95
PID 3432 wrote to memory of 3852	3432	svchost.exe	96
PID 3432 wrote to memory of 3852	3432	svchost.exe	96
PID 3432 wrote to memory of 3852	3432	svchost.exe	96
PID 3432 wrote to memory of 404	3432	svchost.exe	107
PID 3432 wrote to memory of 404	3432	svchost.exe	107
PID 3432 wrote to memory of 404	3432	svchost.exe	107
PID 3432 wrote to memory of 3112	3432	svchost.exe	109
PID 3432 wrote to memory of 3112	3432	svchost.exe	109
PID 3432 wrote to memory of 3112	3432	svchost.exe	109

C:\Users\Admin\AppData\Local\Temp\5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5175cd282f9f7304d525b068ac6290d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3852
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:404
    - - C:\Windows\SysWOW64\at.exe
        
        at 00:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 3094cec7b27e6108f6b05e8940eb25ceb09f0535f4d996250c74dc4119d6bdac
MD5 1979d32740f4d1b8f847c74ca6462352
SHA1 df871d119f50b9a333f2c234aa7e87ea2bd08a25
SHA512 e54543cc6e299c5afbbde7ab693c44ba16ea12ebf309dae230c173455cd19b06581840c0503aac82d9a83ea4b60d5ff2e298fab7af6c53fbaa5f6a445479233e
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oue:7WNqkOJWmo1HpM0MkTUmue
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 f16ef6c310185f64bb3e7bd9b11233f4aea1ad90bf08d024551dc5689a382f06
MD5 aa0fca56694324ee232248261506dd9e
SHA1 c3575f198063f46d92754b38c94879707088d3da
SHA512 3d4546907954bf14b4216b822aa59980b0a3a648163cbf6cdc8f209c08cd16b31b3db634fc00740501cb28d3a63ba29afaeade2a5495e351716915134bc9f71a
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Our:7WNqkOJWmo1HpM0MkTUmur
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 9865767a74d92bbe14b1b8492cbc55b186b9bb1da4d2c8361952523dd1bbdf33
MD5 a1e4709723a18735a57a4194563fa37a
SHA1 78fac7b010917886cb3a0b9e36fe2092b26a229a
SHA512 67d8c01123dadd057d96309f6f2db710d9590107508c701e46e0ecd2db6bba1b4ba4e8468fe4674406da2212db8f25eac60b8e17962fc44a6b3b165eb783b5d8
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OunQ3Q3Q3Q3Q3Q3Q3Q3Q3Z:7WNqkOJWmo1HpM0MkTUmunQ3Q3Q3Q3QB
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 8bce08a76d82837feed0b99656d46fdd9dce5dbde820b77b435e1f3ac71b20bd
MD5 568534c5eb22e13828971e7ac5de48ea
SHA1 624fb8b2403307fabc83ea76d5469564a5c70c34
SHA512 72756685ce2660839ec4353504f31f73e308b0e141e0c9c073a41ac367f90f9c9f78a076c34ba2d0a483e6ca6c9e3a9dc32bb86cb455e85e837077ec71a0c142
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuG:7WNqkOJWmo1HpM0MkTUmuG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1836-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1836-44-0x0000000074C80000-0x0000000074DDD000-memory.dmp

Download

memory/1836-43-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2412-2-0x0000000074C80000-0x0000000074DDD000-memory.dmp

Download

memory/2412-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2412-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2412-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2412-35-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/2412-39-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2412-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/2412-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2412-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3432-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3432-36-0x0000000074C80000-0x0000000074DDD000-memory.dmp

Download

memory/4036-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4036-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4036-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4036-14-0x0000000074C80000-0x0000000074DDD000-memory.dmp

Download

memory/4036-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4380-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4380-25-0x0000000074C80000-0x0000000074DDD000-memory.dmp

Download