Analysis
-
max time kernel
146s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe
-
Size
2.3MB
-
MD5
5cece2b38365e871d77c40f184bcd4a0
-
SHA1
54cbe07bd2ba9dd35359ac8ca73bd4e0bbb927a8
-
SHA256
b8728af4c235ea85ff169eb1f72aacb57bf936f397ff8c4d94707d3d4adb96ea
-
SHA512
30d2d32ff00dc798eae6c2327678536c3ff9db31921e3f87a13f7dd535777c81c83fb0e1e19ec3ecb14f3ca29072ae6732c80f4689ad49481cf5fa14a86b566f
-
SSDEEP
49152:jjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:jrkI9rSjA5aDo73pzF2bz3p9y4HgIoov
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Windows\SysWOW64\shervans.dll acprotect -
Executes dropped EXE 2 IoCs
Processes:
ctfmen.exesmnss.exepid process 2500 ctfmen.exe 2512 smnss.exe -
Loads dropped DLL 9 IoCs
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exectfmen.exesmnss.exeWerFault.exepid process 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe 2500 ctfmen.exe 2500 ctfmen.exe 2512 smnss.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exesmnss.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exesmnss.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe -
Drops file in System32 directory 12 IoCs
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exesmnss.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shervans.dll 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\satornas.dll 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\grcopy.dll 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\smnss.exe 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shervans.dll 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exesmnss.exepid process 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe 2512 smnss.exe 2512 smnss.exe -
Drops file in Program Files directory 64 IoCs
Processes:
smnss.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\ast.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm smnss.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm smnss.exe File opened for modification C:\Program Files\GrantStep.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml smnss.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1656 2512 WerFault.exe smnss.exe -
Modifies registry class 6 IoCs
Processes:
smnss.exe5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
smnss.exedescription pid process Token: SeDebugPrivilege 2512 smnss.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exesmnss.exepid process 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe 2512 smnss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exectfmen.exesmnss.exedescription pid process target process PID 1992 wrote to memory of 2500 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe ctfmen.exe PID 1992 wrote to memory of 2500 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe ctfmen.exe PID 1992 wrote to memory of 2500 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe ctfmen.exe PID 1992 wrote to memory of 2500 1992 5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe ctfmen.exe PID 2500 wrote to memory of 2512 2500 ctfmen.exe smnss.exe PID 2500 wrote to memory of 2512 2500 ctfmen.exe smnss.exe PID 2500 wrote to memory of 2512 2500 ctfmen.exe smnss.exe PID 2500 wrote to memory of 2512 2500 ctfmen.exe smnss.exe PID 2512 wrote to memory of 1656 2512 smnss.exe WerFault.exe PID 2512 wrote to memory of 1656 2512 smnss.exe WerFault.exe PID 2512 wrote to memory of 1656 2512 smnss.exe WerFault.exe PID 2512 wrote to memory of 1656 2512 smnss.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5cece2b38365e871d77c40f184bcd4a0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 8924⤵
- Loads dropped DLL
- Program crash
PID:1656
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD51a21dcf2a7225f3b59e6dc22f0a5384a
SHA18dd03c541eb1686e2923d78140d0f0f334bbbe98
SHA256e8e7a23e4380a7e3abb341eea00957dbd8b26b96fee06d176d849acf4c3fbe62
SHA512a7ce44362caee2a60d5024453f43bb81f6bc609521a7040a0146c2076edcffa99ed7c9d2b493a5ce77ba9e33bcf17af719a909c00af1d8bcc48f0ca0758c817d
-
Filesize
2.3MB
MD55ae79de223fde4b8f7478f3a2ab9f9b1
SHA1a612a089389bfb824804dc808dddf466180740bd
SHA256690fa9b04608f81b34c579a35b2033e67cd66049bbea44929132d5108e039d8a
SHA512f93140a7eaecbc6d4dac72c34e477c600af862358f39140edae73739a9d4c976cc8a748a7e157997a8d651a59d4f611cb290f2490434995866e519dd70345c54
-
Filesize
4KB
MD58f4d4cabb1501bd1d0d9958fb8245cea
SHA13cfa4b48374db3adeb12b948fe0f5d0db448384e
SHA256c4d83c503a5f3b4437971ae9fe0e94b2c082f28c4562abb174cede407cf4435e
SHA5122757f94616cffd0aa9dd07eaf8647762f58a1404aa377ab9ad2df760775a0da7c5111c44a1dddeb4cbc35642ef23c5104e7af7d605f8e49130c0e08fa0c80421
-
Filesize
8KB
MD577b07d50f1cbb4bad146ab69272d6d05
SHA1351411e58c9bd4779bcec46a138c36fd9bcc77ae
SHA256068ae574d7ceba398d2f66ee83bd92d666af2667617ca83a37dbb0ffca31f6e4
SHA5121da14904d9aad88506b13098cf47b60e985c8bada173f8a95fcea10e6a2980f5d9e3ee517b698bbcdc3f5c7f5bea7e3aff6babcba5eb8baec1b6edea210b467a