Malware Analysis Report

2025-01-06 07:35

Sample ID 240613-ft2frsygjm
Target 60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe
SHA256 4711e8af41d87bbdbcd43a9e9d738e9a63e3201dab05abfbac854ae6502818e0
Tags
evasion execution
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

4711e8af41d87bbdbcd43a9e9d738e9a63e3201dab05abfbac854ae6502818e0

Threat Level: Likely malicious

The file 60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe was found to be: Likely malicious.

Malicious Activity Summary

evasion execution

Stops running service(s)

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Launches sc.exe

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 05:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 05:10

Reported

2024-06-13 05:13

Platform

win7-20240611-en

Max time kernel

117s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe"

Signatures

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\1230\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\Service.exe C:\Windows\SysWOW64\1230\smss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2784 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2784 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2784 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2964 wrote to memory of 2704 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2704 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2704 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2704 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2724 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2724 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2724 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2964 wrote to memory of 2724 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

C:\Windows\SysWOW64\1230\smss.exe

C:\Windows\system32\1230\smss.exe -d

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

Network

N/A

Files

\Windows\SysWOW64\1230\smss.exe

MD5 d26c79b75cf9bafb28ca9dec38d7f878
SHA1 a484e0fe571fc377eb6de28d9d812aad11cc5dbe
SHA256 ea7f7aaccca2091ba325233ccc4d91993ac0ffb297f6367a4ee181093c3c81db
SHA512 11557bb6bfe6c89c1c47b66fe44b2dd1a5a2b216b28c96d163731e3d3d5f33655449e0e3afc3ddbc4fec13159ef5670429a4b3a2546c79ab694d3c9a752f9f9f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 05:10

Reported

2024-06-13 05:13

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe"

Signatures

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\1230\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\Service.exe C:\Windows\SysWOW64\1230\smss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1368 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1368 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1368 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1368 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1368 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\sc.exe
PID 1368 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 1368 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 1368 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe C:\Windows\SysWOW64\1230\smss.exe
PID 3384 wrote to memory of 1132 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3384 wrote to memory of 1132 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3384 wrote to memory of 1132 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3384 wrote to memory of 2488 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3384 wrote to memory of 2488 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3384 wrote to memory of 2488 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\60fd696186fe29b550b78bb4272c0bf0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

C:\Windows\SysWOW64\1230\smss.exe

C:\Windows\system32\1230\smss.exe -d

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\Windows\SysWOW64\1230\smss.exe

MD5 749fd78015c43c4df2ed3a07e4304531
SHA1 38e039258d1ff8a8a7217d63675aec34d2d69102
SHA256 81cf7e2670c1376063d1be82c74553451e8591fd8118381ed930ce2d1f486dd4
SHA512 11f0ce3fd6d2e5ebc18a4382c06582373d7d13e094d7b0e86a85a9685f85808e37851da05b9c6b270d82a933e1eee3aca1c443e8238d3e40eb8650188089d72a