Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll
Resource
win7-20240611-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll
-
Size
55KB
-
MD5
5ba1a12a7cbea83dbf762ff77df30d10
-
SHA1
02cac2f0b015046b9de5286051d739a58bc361c2
-
SHA256
76257cf198f03b92111dd8ca6024f96a95e67ac4359c479bf0adf30312513ba3
-
SHA512
2878626f52fd2da4d3c811f2dd9e7f1a9a7655e5293b17137b09ec510e3e435982764b4070fae26fea0e9f917e7de17dd99b2a2296471656a884c8e44888a01a
-
SSDEEP
1536:6IAg0rGQCQdd9j24avwsSS4qHpiajxv+jGsNkKt1Llj:6Ib0rvd9j24avwsVdJbjxv+jGsNkS1pj
Score
1/10
Malware Config
Signatures
-
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\FriendlyName = "Cyberlink Dump Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\CLSID = "{9BC7E140-912D-11D3-B1AD-0080C84E9C15}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\ = "Cyberlink Dump Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\ = "CyberLink Dump Filter Property" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\InprocServer32 regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\FilterData = 020000000000200001000000000000003070693302000000000000000100000000000000000000003074793300000000380000003800000000000000000000000000000000000000 regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28 PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28 PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28 PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28 PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28 PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28 PID 2632 wrote to memory of 2208 2632 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll2⤵
- Modifies registry class
PID:2208
-