Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 02:46
Static task
static1
Behavioral task
behavioral1
Sample
5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe
-
Size
368KB
-
MD5
5840c1688f54eb98308d33aba1e3b0f0
-
SHA1
16fb59a97f3a703055a8e82b39af8573e82fdaa3
-
SHA256
057db4e22fafc7beb6b3a32b36c726edf94a23c774aefaf25d09866332b34f40
-
SHA512
0189b21277fd3fbebf134cdcccc4811e866f090378240e303e2388d9a47f111b6eb07c0ab197df695b17cba66f0b86fe7154467ff196f4f862b7d4e5bb50b1f9
-
SSDEEP
6144:Gk3v2BsHkq8xJYd1BeJuESHr4YWzOMlql49e1/lcduanJntih/FlVjf5PfbZjo/E:nv2BsHkq8xJYdlEC4YWzZvRMUqD
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeeowud.exe -
Executes dropped EXE 1 IoCs
pid Process 1196 zeeowud.exe -
Loads dropped DLL 2 IoCs
pid Process 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /q" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /w" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /j" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /z" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /g" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /d" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /h" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /o" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /w" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /p" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /c" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /f" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /e" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /r" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /y" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /v" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /v" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /n" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /j" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /k" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /n" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /u" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /y" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /m" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /f" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /d" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /t" 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /a" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /i" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /o" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /t" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /s" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /e" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /r" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /z" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /l" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /b" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /u" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /p" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /g" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /h" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /l" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /m" 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /k" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /c" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /x" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /b" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /t" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /s" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /i" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /m" zeeowud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /q" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /a" zeeowud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zeeowud = "C:\\Users\\Admin\\zeeowud.exe /x" zeeowud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe 1196 zeeowud.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 zeeowud.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 1196 zeeowud.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1196 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 1196 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 1196 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 1196 3024 5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5840c1688f54eb98308d33aba1e3b0f0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\zeeowud.exe"C:\Users\Admin\zeeowud.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
368KB
MD592985c61d13ad4b3eaec75896a09be81
SHA14729d43978e8129be54efd9a7294a8c149c663a2
SHA2564cfa308222c0a054f0b648e9072db05c6a560c4d51c2da7b3a7a76606697f876
SHA512325c9e8f045dde881f2e5648002ad1e723bc2b9aef593a1be6f7eddc3bdbad249f1111c5000c7093be4cf3fd11fd63711268e7da71cf8bbbe1694805b0e45c97