Analysis

  • max time kernel
    150s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 02:29

General

  • Target

    571c5022756bb721647aae39b5379aa0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    571c5022756bb721647aae39b5379aa0

  • SHA1

    d6208f3bb23f148a6aa2c356022161967db64e70

  • SHA256

    c18809027005c9b3d232bcb745e3f9531e26f913edb57e0e0eb1fc05a982b191

  • SHA512

    b15666bd0ce7bbd8bd316ea44bef384b16e97629f2035a50b662623412ca7e013123649641e1fbe6c36144422acbe41bdcbfefa856a32787bb702fee5995c808

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiY:IeklMMYJhqezw/pXzH9iY

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\571c5022756bb721647aae39b5379aa0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\571c5022756bb721647aae39b5379aa0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2288
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4056
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3340
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5056
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3980
          • C:\Windows\SysWOW64\at.exe
            at 02:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:5036
            • C:\Windows\SysWOW64\at.exe
              at 02:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3508
              • C:\Windows\SysWOW64\at.exe
                at 02:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1176

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          c52938ad7b2355da6796d286c2d502f9

          SHA1

          8762200c5c60efc59d530747caa00766fa8d6d46

          SHA256

          d3626d629ddfbafd714dd77c380ece392f14c51a88e69e0a5442b131c0eb9051

          SHA512

          66721acd465e82fb32fa07e53a3c832817f1ffc26088395b8724dda283aba1596876e79da9f72144aeb8800fa248dde1fc976cf74bb5e6182f3b4e8535799778

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          b6770eedaaa05c8d3dada4abd3e32fe9

          SHA1

          d3469ee1bfbac4e6cf2ed2ec6ba12038dec07bd8

          SHA256

          c187e56f2ede258af48dcd8c1429d4e1517a8df364515e809dd2bd460b7d56b1

          SHA512

          241be9b933f715766136a906789918391f4df9cf8e3f5807835d8de0f75155e326b127e4d91016881d598866025e7f43783810ca55904732bcb83cc44c643592

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          a247063dd68ab5f28738a172a5c2b273

          SHA1

          06596c6114df87002944af0d923791b6234ea544

          SHA256

          48bee8edf8534f05b4523f133fd63be492289e6ed08fb435421c2be115f44b4a

          SHA512

          6328058add538dd079f652925d4bf2b7775582e13349c963d63d33447170ab0abbb03b13ed099ef1b55c2d64e88cfaea5f5563663b7dd7b9295af5cb8b92a462

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          ba30937a9af1440d430451dffa72fa9d

          SHA1

          ff47352ef32584c35fee3e855c8b5e632bb6b912

          SHA256

          02ed3a0f85085af9d69d6a03bb3d8009eeb73c90f943b85e2ce59717e23746e2

          SHA512

          f832888f0620f62c70825452e5517dca62ad439ff1f5ef19c7fb960411942577fc67a04ab9dfd7a5462f1e5073d0c097d054b75c2eee11abb4798d46ce3d7005

        • memory/2288-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2288-2-0x0000000074D90000-0x0000000074EED000-memory.dmp

          Filesize

          1.4MB

        • memory/2288-58-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2288-59-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2288-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2288-5-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2288-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/2288-45-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/3340-26-0x0000000074D90000-0x0000000074EED000-memory.dmp

          Filesize

          1.4MB

        • memory/3340-54-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3340-32-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3340-25-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3340-29-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3980-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3980-46-0x0000000074D90000-0x0000000074EED000-memory.dmp

          Filesize

          1.4MB

        • memory/4056-18-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4056-14-0x0000000074D90000-0x0000000074EED000-memory.dmp

          Filesize

          1.4MB

        • memory/4056-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4056-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4056-13-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5056-43-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/5056-38-0x0000000074D90000-0x0000000074EED000-memory.dmp

          Filesize

          1.4MB

        • memory/5056-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB