Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 02:17

General

  • Target

    5669dad4caa24be995a62af657b34270_NeikiAnalytics.exe

  • Size

    206KB

  • MD5

    5669dad4caa24be995a62af657b34270

  • SHA1

    1d678b256f6d0c06d732346ba84e81815fc7efff

  • SHA256

    5872ec205ce65b045bb15b876c42e4f5ecf10d66fcec5c61aac0d54c758df24f

  • SHA512

    ff6b58442f788b8c19cc0902f2b116af50d67de49d885fc9d9da70f57ee5ff6c5060463ebdecf0b981106a4bd1a00b252543d265ef912b18f9edeba1a8b1b9ba

  • SSDEEP

    3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL8VVVVVVVVVVVVVVVVVVVVu:5vEN2U+T6i5LirrllHy4HUcMQY6KP

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5669dad4caa24be995a62af657b34270_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5669dad4caa24be995a62af657b34270_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3744
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:764
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5008
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:556
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4884
          • C:\Windows\SysWOW64\at.exe
            at 02:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2008
            • C:\Windows\SysWOW64\at.exe
              at 02:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3252
              • C:\Windows\SysWOW64\at.exe
                at 02:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:696

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          206KB

          MD5

          0ba6f9920d8eee7a12b2e35c83030b32

          SHA1

          b70ad36fca27846247ced057e421a8940b3dd019

          SHA256

          1de7d575389ad2a9823d7db34ed257cdb4d6591d69c8bc58cfa5a21e308a7416

          SHA512

          34014db71aa601ead0ed775767c967bac81256b42c116d83703641529479ea4740632f2e32f70c0ba5dbc1a546ead8c210c45ddb61eca8dca10d1c998dddb776

        • C:\Windows\System\explorer.exe

          Filesize

          206KB

          MD5

          e7d37222ac884efefda8c1b2b6bcd900

          SHA1

          da2687c6c2987e24719063a7c2d35407fc503491

          SHA256

          ebc3073ec10a58dfc60a6120ed208cc3e6991df3db325d6d9e935bd2e0c9c583

          SHA512

          e3655081735a154f0f16d8eea4095ba706ad496b0eba7bfa6d3b589b771b0cc570fb65090cbced8a9ccac6cfdf9335968bd0c7d9212fe43a2f8ba73527dad49f

        • C:\Windows\System\spoolsv.exe

          Filesize

          206KB

          MD5

          2f308138401d15bf2f0ba7d883c53aee

          SHA1

          0416a48a48a9bbbc47120a38b087fc4c64874b4c

          SHA256

          43d6ce5a104ecd9e1c3c4252588f7e9fcf866b36bc5ed40e03eebe6913ca2693

          SHA512

          d50d425b56426e98104cbea31cc5c419b4ca15dc79d7302c66633b57bb6c24513dee16a4b29a4c757222d5ce5ce7fad9f05d059b63b21e5bf192b7fc9ecb2d1a

        • C:\Windows\System\svchost.exe

          Filesize

          207KB

          MD5

          2012a2a00cba661731062dfd2d6b8d87

          SHA1

          dd4aab59ffff4bc541d019c5418940527155e0f7

          SHA256

          38463cebf00fd138e286b5313bb43df6dc7befadfab5795db3254b19c61ea9aa

          SHA512

          914aa8acba319a22acf6d60723efa20860cc03517fa9ff175e4b8b5261297f82f02d0d58c30dd47768dc7692988959fa8e88f1cbf0ea8df8f03efe8788014bfe

        • memory/3744-0-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/3744-36-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/4884-32-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/5008-35-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB