Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 02:32

General

  • Target

    5771889b251164837e9a6c608ac6d280_NeikiAnalytics.exe

  • Size

    206KB

  • MD5

    5771889b251164837e9a6c608ac6d280

  • SHA1

    1961588673fd950561906c26c237e98722aa5b0e

  • SHA256

    9d62a406011dbe8aa463e912780962cbfa75d7a2ce55fd05241ad92e5eac257c

  • SHA512

    005dc6d71b968bc2431d2331cae3281e45393b70cd137f7bf011c1abdccd408ef874ad8dfb50cd401994a06623a233c7f7a5592eadc6348d4ff83607976e26d3

  • SSDEEP

    3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLl:5vEN2U+T6i5LirrllHy4HUcMQY6Kl

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5771889b251164837e9a6c608ac6d280_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5771889b251164837e9a6c608ac6d280_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:344
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3492
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4360
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2548
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1620
          • C:\Windows\SysWOW64\at.exe
            at 02:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1468
            • C:\Windows\SysWOW64\at.exe
              at 02:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3916
              • C:\Windows\SysWOW64\at.exe
                at 02:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3108

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          206KB

          MD5

          b717ea7508c11b53d62deadc9bbfdc8e

          SHA1

          c0bcb68a9c6e795ea5bfe98f59aa5f18f7a457da

          SHA256

          b1fea8e96c8ce4ce725a9641955f3de9c4769b9a79b7e7fd8f945d55b76468d7

          SHA512

          a989397584bd5c31490c817515f0dbd9f7a614508c4ab15ff2e352255ca3c908240dd4dfd7465e29dfe447c13f5a2829e0b6f72b8d4c627e6f36e6d6a7ecd22b

        • C:\Windows\System\explorer.exe

          Filesize

          206KB

          MD5

          962a34034c931c83bb56e5691d584499

          SHA1

          8ba8e98eaf2ff22ac9dc9fde71c93614390c4f14

          SHA256

          320344cb9ac4311938d0e19c58d2a1ff6b4237002dc7145fb5d446e59d297531

          SHA512

          c5028dcf352f976818eb1ec2c9fa3b475f87217d553fb4d0f986cb1a63758d0758be78902c7c9915ee6ea7a95c751f48e9f84fe21e79b4fc947f132abd35f465

        • C:\Windows\System\spoolsv.exe

          Filesize

          206KB

          MD5

          fa22c504e7aa79631902d5ea20ea0546

          SHA1

          caac4cfba8e0b62a3306f057e550fa078f1412cd

          SHA256

          494abd68eead0c9cc3a313305270ddd4ec162f2b31da0aa7deb635319801324b

          SHA512

          6ad02f443d3c7cb5c15a893911caf9ced3dff49576cc31c9d44b2356d932eba077b005ad100079ef5229f259b25f9f129433ad6854278f92340415810b083187

        • C:\Windows\System\svchost.exe

          Filesize

          206KB

          MD5

          f52fd3090da06bd5614c6d1d97f236f2

          SHA1

          f88313835acd9ebada27103af8091cbb3e0839f2

          SHA256

          25282e8edfb7e3dae0f677640f0001954032185e0321987e3892b6e30bb55c68

          SHA512

          65fca2776719346785b9912af84d0ab428aa93eab4a1283d0107252775a89cd66afceda2c8d838b3ea91760a59f48cb2d3f01eb3011dd60be38764378de158c0

        • memory/344-0-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/344-37-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/1620-35-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/4360-17-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/4360-36-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB