Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll
Resource
win7-20240611-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll
-
Size
55KB
-
MD5
5ba1a12a7cbea83dbf762ff77df30d10
-
SHA1
02cac2f0b015046b9de5286051d739a58bc361c2
-
SHA256
76257cf198f03b92111dd8ca6024f96a95e67ac4359c479bf0adf30312513ba3
-
SHA512
2878626f52fd2da4d3c811f2dd9e7f1a9a7655e5293b17137b09ec510e3e435982764b4070fae26fea0e9f917e7de17dd99b2a2296471656a884c8e44888a01a
-
SSDEEP
1536:6IAg0rGQCQdd9j24avwsSS4qHpiajxv+jGsNkKt1Llj:6Ib0rvd9j24avwsVdJbjxv+jGsNkS1pj
Score
1/10
Malware Config
Signatures
-
Modifies registry class 14 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\FilterData = 020000000000200001000000000000003070693302000000000000000100000000000000000000003074793300000000380000003800000000000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\ = "CyberLink Dump Filter Property" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\FriendlyName = "Cyberlink Dump Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\CLSID = "{9BC7E140-912D-11D3-B1AD-0080C84E9C15}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E140-912D-11D3-B1AD-0080C84E9C15}\ = "Cyberlink Dump Filter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BC7E141-912D-11D3-B1AD-0080C84E9C15}\InprocServer32\ThreadingModel = "Both" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 916 wrote to memory of 1564 916 regsvr32.exe 82 PID 916 wrote to memory of 1564 916 regsvr32.exe 82 PID 916 wrote to memory of 1564 916 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll1⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5ba1a12a7cbea83dbf762ff77df30d10_NeikiAnalytics.dll2⤵
- Modifies registry class
PID:1564
-