Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 02:29

General

  • Target

    571c5022756bb721647aae39b5379aa0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    571c5022756bb721647aae39b5379aa0

  • SHA1

    d6208f3bb23f148a6aa2c356022161967db64e70

  • SHA256

    c18809027005c9b3d232bcb745e3f9531e26f913edb57e0e0eb1fc05a982b191

  • SHA512

    b15666bd0ce7bbd8bd316ea44bef384b16e97629f2035a50b662623412ca7e013123649641e1fbe6c36144422acbe41bdcbfefa856a32787bb702fee5995c808

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiY:IeklMMYJhqezw/pXzH9iY

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\571c5022756bb721647aae39b5379aa0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\571c5022756bb721647aae39b5379aa0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2228
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1236
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2780
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2188
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2728
          • C:\Windows\SysWOW64\at.exe
            at 02:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2320
            • C:\Windows\SysWOW64\at.exe
              at 02:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1160
              • C:\Windows\SysWOW64\at.exe
                at 02:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1808

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          a0e88150548141b1675e082a155aaba4

          SHA1

          38daa2d472e9c79f2281131cff819f28cb7caf2c

          SHA256

          56e04cbeefbb9c82ae2435edea022e16a454b0a4a47dd57750a3f05dcc36c825

          SHA512

          f855b68a8ff9b9b41859d4a5b900df0288dc3a7dfb848daef3901fd7dd52de8d8cf91b38f842ca089309a01ee0a21baee1e3ed5c503350b724eac39d8cb90c10

        • C:\Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          9e6daa9c316bd3bc871cf1f194f94d72

          SHA1

          ba59a04855e75a6bb697d565641fda0c2eec13e1

          SHA256

          874c5a99b90c449a53554b8e1b07ea24e837e7aea0a45ac3121815365a0cd0b2

          SHA512

          74e9ec848fa4256ef18e174b3595fe7ec32a5e60efca0ae9775b477b6b60c6c3ea83663da84afe072198e3356bf5ac5097307900d675b310ce0c66723811c025

        • C:\Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          839ae3533304e8b17620e65dd022a295

          SHA1

          e4d42418983bdfc3cb32954d66e2c7bc0f85d999

          SHA256

          bbad28b1ff63fb6940a0c7cc1459b5fcd7b9080a4204f453f6a3a41cab5172db

          SHA512

          fdc5cd032362c6eb36c6f7d76fd5a070c6be04927e8e187366df9c14bd25aa736574014dbde8277c31504acf11c810c32177d41c3d252f31bf1189a042b39721

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          e2c576f6bd739cae9e690f751fca3185

          SHA1

          5a1d59228759a8142958989836afee7009e99328

          SHA256

          e218fdcc5dba882a23c377027731752983defdbb959650148f98cc6b685b5d4d

          SHA512

          c334b0c4be6df1d181e6a814acb6eca6dfdb9aff7b6a8fc4998904853881990c09ce561efd15a5f171da512923092a122f3a949ed0067902f6c1c9c2468cc7c4

        • memory/1236-19-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1236-81-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1236-20-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/1236-24-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1236-91-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1236-44-0x0000000002710000-0x0000000002741000-memory.dmp

          Filesize

          196KB

        • memory/2188-82-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2188-58-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2188-54-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2188-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2228-18-0x0000000002500000-0x0000000002531000-memory.dmp

          Filesize

          196KB

        • memory/2228-78-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2228-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2228-17-0x0000000002500000-0x0000000002531000-memory.dmp

          Filesize

          196KB

        • memory/2228-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2228-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2228-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2228-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2228-77-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2228-79-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2728-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2728-64-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2728-69-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2780-45-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2780-73-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2780-36-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB