Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 02:32

General

  • Target

    5771889b251164837e9a6c608ac6d280_NeikiAnalytics.exe

  • Size

    206KB

  • MD5

    5771889b251164837e9a6c608ac6d280

  • SHA1

    1961588673fd950561906c26c237e98722aa5b0e

  • SHA256

    9d62a406011dbe8aa463e912780962cbfa75d7a2ce55fd05241ad92e5eac257c

  • SHA512

    005dc6d71b968bc2431d2331cae3281e45393b70cd137f7bf011c1abdccd408ef874ad8dfb50cd401994a06623a233c7f7a5592eadc6348d4ff83607976e26d3

  • SSDEEP

    3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLl:5vEN2U+T6i5LirrllHy4HUcMQY6Kl

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5771889b251164837e9a6c608ac6d280_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5771889b251164837e9a6c608ac6d280_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2036
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2432
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2288
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2748
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2756
          • C:\Windows\SysWOW64\at.exe
            at 02:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2632
            • C:\Windows\SysWOW64\at.exe
              at 02:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1672
              • C:\Windows\SysWOW64\at.exe
                at 02:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2004

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          206KB

          MD5

          3f112b5d2636b918c77d13bd712a6977

          SHA1

          e8bd19fed478de1974f077cf2c30535c99d910d1

          SHA256

          b8309f3d63ea61f6ffd76822e1cbb4909d392bc03e87565b3de28b42d2c31548

          SHA512

          3739e1b627ee1c85be50d075fff3d48f933399c371a1f08ca4e6460b97a00883fe37c33e9b362440040dfc5641b7a76955e2bee357467a1df9b5f17d68bc53cb

        • C:\Windows\system\svchost.exe

          Filesize

          206KB

          MD5

          d6fab99d2f318e09e0f9bf03cac41173

          SHA1

          a389f96d591c36153e4da245f0f3ccb6eae627d5

          SHA256

          2dfadf8b320675695d239bfc451331bfcdb3ea81c4b8f8ee36eb814c43a90688

          SHA512

          de772c18d69c56fcd44eb7ac9f6150327bd67932f40a104321ae0c862b0fc8113b2ce2cf5ca993066d82ada2cfd96090e7e6571efed15db6bfb7dcf8c54c64d2

        • \Windows\system\explorer.exe

          Filesize

          206KB

          MD5

          bdd884b6d8781b63db2ea1851c939550

          SHA1

          67e70d4638fb4d03a9239273edd60e1bac13744f

          SHA256

          dd96b47fda1e0e28a856760438632e226428a1c9749c014d4b7e9f31170cdd6b

          SHA512

          cef2f2c8518ab704f5951ff12bf944f6dd1c50297117e50437e2b0533ca7de1a664475dab9bc837c6a9180e624dea285f80436c8e762545d9aed16e0c87944e1

        • \Windows\system\spoolsv.exe

          Filesize

          206KB

          MD5

          6e9bae3e8379b73e9aa19e411117652f

          SHA1

          421e31a79976a09b943bbd923cb37b7cf7243adb

          SHA256

          72f4bc9a4375cebbcca7cc6dbc5c253e4e928fba7b55b981a5d7707d6c6ef282

          SHA512

          a6693939830cb5abdb82d2893aa95dfb89ff8ffe7f1e78643f9fb74eda61ee8754f887031e0d18644cce8b6d082a284dadb715625fafd9aa3d48687889dc17fd

        • memory/2036-0-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2036-13-0x0000000000820000-0x0000000000860000-memory.dmp

          Filesize

          256KB

        • memory/2036-56-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2288-54-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2432-14-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2432-29-0x0000000001E10000-0x0000000001E50000-memory.dmp

          Filesize

          256KB

        • memory/2756-55-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB