c9775b084e3456bc7beb320f45c5d1181b84ea42d396ae09e41cd3cedb31ea41

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe
Size 21KB
Sample240613-dkcd6swbkm
SHA256 c9775b084e3456bc7beb320f45c5d1181b84ea42d396ae09e41cd3cedb31ea41
MD5 595f2e93b06dd486f3eb92e113f95b40
SHA1 4fef26508e79f2f4f1094151bc5208ff74ccd7cb
SHA512 8ab26d193d6234bbb8cc2608d235535daf3fa08fb1730b923f2340bca3571393008dacc7061ac83486e08bd7b7ac007c90623c5dd0ac080bcae7ec43effbddcf
SSDEEP 384:g58AcUoUQKNRYELxQUHDvmk3E+KDvB77777J77c77c77c72qh5ZaP9YNCcTjew:g5BOFKksO1mE9B77777J77c77c77c71f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\2DD1889.exe\""	2DD1889.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\2DD1889.exe\""	2DD1889QTQTTZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\2DD1889.exe\""	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe

Executes dropped EXE 5 IoCs

pid	Process
3512	2DD1889.exe
3436	2DD1889QTQTTZ.exe
3816	2DD1889QTQTTZ.exe
956	2DD1889.exe
2896	2DD1889.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3124-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x0007000000023448-7.dat	upx
behavioral2/memory/3512-10-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x0007000000023449-14.dat	upx
behavioral2/memory/3436-15-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3816-24-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/956-29-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2896-35-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3124-37-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-38-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-39-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-40-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-41-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-42-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-43-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-45-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-44-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-47-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-46-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-48-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-49-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-51-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-50-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-53-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-52-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-55-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-54-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-56-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-57-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-58-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-59-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-60-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-61-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-62-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-63-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-64-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-65-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3512-66-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3436-67-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2DD1889.exe = "C:\\Windows\\2DD1889.exe"	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2DD1889.exe = "C:\\Windows\\2DD1889.exe"	2DD1889.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2DD1889.exe = "C:\\Windows\\2DD1889.exe"	2DD1889QTQTTZ.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\2DD1889.exe	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe
File opened for modification	C:\Windows\2DD1889QTQTTZ.exe	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe

Kills process with taskkill 42 IoCs

evasion

pid	Process
2556	TASKKILL.exe
4332	TASKKILL.exe
2972	TASKKILL.exe
2876	TASKKILL.exe
988	TASKKILL.exe
4944	TASKKILL.exe
444	TASKKILL.exe
4216	TASKKILL.exe
1740	TASKKILL.exe
4004	TASKKILL.exe
4204	TASKKILL.exe
3500	TASKKILL.exe
4708	TASKKILL.exe
3660	TASKKILL.exe
4832	TASKKILL.exe
4480	TASKKILL.exe
1112	TASKKILL.exe
2708	TASKKILL.exe
1316	TASKKILL.exe
4516	TASKKILL.exe
1556	TASKKILL.exe
4876	TASKKILL.exe
4704	TASKKILL.exe
944	TASKKILL.exe
2944	TASKKILL.exe
312	TASKKILL.exe
2256	TASKKILL.exe
224	TASKKILL.exe
1544	TASKKILL.exe
4604	TASKKILL.exe
4988	TASKKILL.exe
3328	TASKKILL.exe
3216	TASKKILL.exe
4528	TASKKILL.exe
3480	TASKKILL.exe
4804	TASKKILL.exe
1480	TASKKILL.exe
3636	TASKKILL.exe
1100	TASKKILL.exe
3808	TASKKILL.exe
1192	TASKKILL.exe
4468	TASKKILL.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	444	TASKKILL.exe
Token: SeDebugPrivilege	4832	TASKKILL.exe
Token: SeDebugPrivilege	1192	TASKKILL.exe
Token: SeDebugPrivilege	1100	TASKKILL.exe
Token: SeDebugPrivilege	312	TASKKILL.exe
Token: SeDebugPrivilege	2256	TASKKILL.exe
Token: SeDebugPrivilege	1556	TASKKILL.exe
Token: SeDebugPrivilege	2556	TASKKILL.exe
Token: SeDebugPrivilege	2944	TASKKILL.exe
Token: SeDebugPrivilege	4988	TASKKILL.exe
Token: SeDebugPrivilege	4216	TASKKILL.exe
Token: SeDebugPrivilege	3660	TASKKILL.exe
Token: SeDebugPrivilege	4480	TASKKILL.exe
Token: SeDebugPrivilege	3808	TASKKILL.exe
Token: SeDebugPrivilege	1740	TASKKILL.exe
Token: SeDebugPrivilege	4468	TASKKILL.exe
Token: SeDebugPrivilege	4004	TASKKILL.exe
Token: SeDebugPrivilege	1112	TASKKILL.exe
Token: SeDebugPrivilege	4332	TASKKILL.exe
Token: SeDebugPrivilege	2708	TASKKILL.exe
Token: SeDebugPrivilege	1544	TASKKILL.exe
Token: SeDebugPrivilege	988	TASKKILL.exe
Token: SeDebugPrivilege	944	TASKKILL.exe
Token: SeDebugPrivilege	3480	TASKKILL.exe
Token: SeDebugPrivilege	4204	TASKKILL.exe
Token: SeDebugPrivilege	4704	TASKKILL.exe
Token: SeDebugPrivilege	4944	TASKKILL.exe
Token: SeDebugPrivilege	2876	TASKKILL.exe
Token: SeDebugPrivilege	4876	TASKKILL.exe
Token: SeDebugPrivilege	224	TASKKILL.exe
Token: SeDebugPrivilege	3500	TASKKILL.exe
Token: SeDebugPrivilege	3636	TASKKILL.exe
Token: SeDebugPrivilege	3328	TASKKILL.exe
Token: SeDebugPrivilege	4516	TASKKILL.exe
Token: SeDebugPrivilege	2972	TASKKILL.exe
Token: SeDebugPrivilege	4804	TASKKILL.exe
Token: SeDebugPrivilege	4708	TASKKILL.exe
Token: SeDebugPrivilege	1316	TASKKILL.exe
Token: SeDebugPrivilege	3216	TASKKILL.exe
Token: SeDebugPrivilege	4604	TASKKILL.exe
Token: SeDebugPrivilege	4528	TASKKILL.exe
Token: SeDebugPrivilege	1480	TASKKILL.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe
3512	2DD1889.exe
3436	2DD1889QTQTTZ.exe
3816	2DD1889QTQTTZ.exe
956	2DD1889.exe
2896	2DD1889.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1100	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	82
PID 3124 wrote to memory of 1100	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	82
PID 3124 wrote to memory of 1100	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	82
PID 3124 wrote to memory of 444	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	83
PID 3124 wrote to memory of 444	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	83
PID 3124 wrote to memory of 444	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	83
PID 3124 wrote to memory of 3660	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	84
PID 3124 wrote to memory of 3660	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	84
PID 3124 wrote to memory of 3660	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	84
PID 3124 wrote to memory of 1192	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	85
PID 3124 wrote to memory of 1192	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	85
PID 3124 wrote to memory of 1192	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	85
PID 3124 wrote to memory of 2556	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	86
PID 3124 wrote to memory of 2556	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	86
PID 3124 wrote to memory of 2556	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	86
PID 3124 wrote to memory of 2256	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	87
PID 3124 wrote to memory of 2256	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	87
PID 3124 wrote to memory of 2256	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	87
PID 3124 wrote to memory of 312	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	88
PID 3124 wrote to memory of 312	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	88
PID 3124 wrote to memory of 312	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	88
PID 3124 wrote to memory of 3808	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	89
PID 3124 wrote to memory of 3808	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	89
PID 3124 wrote to memory of 3808	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	89
PID 3124 wrote to memory of 4216	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	90
PID 3124 wrote to memory of 4216	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	90
PID 3124 wrote to memory of 4216	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	90
PID 3124 wrote to memory of 4480	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	92
PID 3124 wrote to memory of 4480	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	92
PID 3124 wrote to memory of 4480	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	92
PID 3124 wrote to memory of 2944	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	93
PID 3124 wrote to memory of 2944	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	93
PID 3124 wrote to memory of 2944	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	93
PID 3124 wrote to memory of 4832	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	95
PID 3124 wrote to memory of 4832	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	95
PID 3124 wrote to memory of 4832	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	95
PID 3124 wrote to memory of 1556	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	96
PID 3124 wrote to memory of 1556	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	96
PID 3124 wrote to memory of 1556	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	96
PID 3124 wrote to memory of 4988	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	97
PID 3124 wrote to memory of 4988	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	97
PID 3124 wrote to memory of 4988	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	97
PID 3124 wrote to memory of 3512	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	110
PID 3124 wrote to memory of 3512	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	110
PID 3124 wrote to memory of 3512	3124	595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe	110
PID 3512 wrote to memory of 2708	3512	2DD1889.exe	111
PID 3512 wrote to memory of 2708	3512	2DD1889.exe	111
PID 3512 wrote to memory of 2708	3512	2DD1889.exe	111
PID 3512 wrote to memory of 2876	3512	2DD1889.exe	112
PID 3512 wrote to memory of 2876	3512	2DD1889.exe	112
PID 3512 wrote to memory of 2876	3512	2DD1889.exe	112
PID 3512 wrote to memory of 4004	3512	2DD1889.exe	113
PID 3512 wrote to memory of 4004	3512	2DD1889.exe	113
PID 3512 wrote to memory of 4004	3512	2DD1889.exe	113
PID 3512 wrote to memory of 1740	3512	2DD1889.exe	114
PID 3512 wrote to memory of 1740	3512	2DD1889.exe	114
PID 3512 wrote to memory of 1740	3512	2DD1889.exe	114
PID 3512 wrote to memory of 944	3512	2DD1889.exe	115
PID 3512 wrote to memory of 944	3512	2DD1889.exe	115
PID 3512 wrote to memory of 944	3512	2DD1889.exe	115
PID 3512 wrote to memory of 4704	3512	2DD1889.exe	116
PID 3512 wrote to memory of 4704	3512	2DD1889.exe	116
PID 3512 wrote to memory of 4704	3512	2DD1889.exe	116
PID 3512 wrote to memory of 4204	3512	2DD1889.exe	117

C:\Users\Admin\AppData\Local\Temp\595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\595f2e93b06dd486f3eb92e113f95b40_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM services.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:312
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM services.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\2DD1889.exe
  C:\Windows\2DD1889.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM services.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4004
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM services.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\2DD1889QTQTTZ.exe
    C:\Windows\2DD1889QTQTTZ.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:3436
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2972
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4708
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3636
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1480
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3500
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4604
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4804
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4944
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4516
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1316
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3328
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:988
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3216
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4528
  - - C:\Windows\2DD1889QTQTTZ.exe
      C:\Windows\2DD1889QTQTTZ.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
  - - C:\Windows\2DD1889.exe
      C:\Windows\2DD1889.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
- - C:\Windows\2DD1889.exe
    C:\Windows\2DD1889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2DD1889.exe

Path C:\Windows\2DD1889.exe
Size 38KB
SHA256 69b7fb6926018591189f0c6a31a23b852273788acb4143e1914e253d1a8b0427
MD5 99e1710d11c09ca4e980bfd6d2e986c7
SHA1 0a5cfb7f6bbbb640423f96f9022f2fd00091cacc
SHA512 893a1b8bb934f4074cf295db14eca7bf734b7faee9997ef38b7873489420593a10c365dd940e6995f8ea5fcc3bc1d399d3a8d7874f5f0bee8e0fd468d6efddd8
SSDEEP 768:g5BOFKksO1mE9B77777J77c77c77c71kr0mlZ5n0EbT5+4hHvlHpMH7INA+m:g8Fs+DB77777J77c77c77c71vmn50aJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

2DD1889QTQTTZ.exe

Path C:\Windows\2DD1889QTQTTZ.exe
Size 26KB
SHA256 32bb0e7c55dec24c5853f76a3a0346ebacbd3ed4e66f6603823cb944c0139780
MD5 b60050e4986ebda75680ced43ce51aa7
SHA1 6a75f2557a09fabf95b5ca404eed598c4b9ca613
SHA512 a2a0c60c1eb8be200cb8a0749ce0d9cdd8f65027d210dc9ada48f0c9fbf36ae66bc6214d21616ac5b07432b59e8c3553ac5a97fda34c2f28c234c16c115d6ae9
SSDEEP 768:g5BOFKksO1mE9B77777J77c77c77c71V+2Ic2Y1qkeF3Z:g8Fs+DB77777J77c77c77c71V+2H51q1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/956-29-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2896-35-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3124-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3124-37-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-39-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-63-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-53-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-61-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-65-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-43-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-45-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-57-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-47-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-67-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-55-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-49-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-51-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-46-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-60-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-52-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-48-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-54-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-56-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-44-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-58-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-42-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-50-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-62-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-38-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-64-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-10-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3512-66-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3816-24-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads