45680b03857dcd9a79296b62eb4f47f1fd8f456179206c280b7f3c156c381de7

General

Target
6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Size 131KB
Sample240613-gflntswejg
SHA256 45680b03857dcd9a79296b62eb4f47f1fd8f456179206c280b7f3c156c381de7
MD5 6307720539ce80c89a5bbfaca3534920
SHA1 1e46b2e87ab9dcbe5b3e18c9a7728335bb9f3070
SHA512 7c79c0f637e8b0be327954f4a3c537d75db346a3c2a1cea26d6a5f541841316529d1b838a61ec4a73794a1af15d133925c38c818510fbae95cb707bf98dc3674
SSDEEP 3072:EW8br+zAYWG/7H93bo7MnTqtQdhZ5Xder9+Yd1PcKr0ApxSqU:2bCzAyzHZdqtQXjIrtT+OSN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4576-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/files/0x000800000002356f-5.dat	upx
behavioral2/memory/4576-26-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\crypto.dll	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4576	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
Token: SeDebugPrivilege	4576	6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6307720539ce80c89a5bbfaca3534920_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 113KB
SHA256 a393835930a4086f6817627fc1fb979c4be03ac9995b76e0fc1cc0386427766a
MD5 290961fda3dab802ca1d6f64966a621a
SHA1 59bdd400e35f128d479faf442ced07c9999d2cf3
SHA512 30c1b825e3489da673c324071f1ea852b7d68e7706dd90685b568208af85543bbcadfb4d4f79ddcd99d0f3ba90d65f814eea8f277bf0264b1338f448d08b69b9
SSDEEP 3072:D3bo7MnTqtQdhZ8W8br+zAYWG/7HE2+fe9KUcxdny:jdqtQXsbCzAyzHEhfQudy
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 146KB
SHA256 1d57163bf0bd16918454b3f2105ec548d83512b8ce58dc53ed9dae27e36e256e
MD5 df4087dcf4563c186a9466d4aad49d90
SHA1 9c249c5de27b48b627e04027c6f57fc97715f1b8
SHA512 c63e5a6d79ba26a657af1476574608b349790ab08f5525fed0765ff3f00553c05929a14c8ad999da601d021952271f3727d68dca6d589f8ed247e81b5a866862
SSDEEP 3072:EW8br+zAYWG/7H93bo7MnTqtQdhZ65p5m3XRA41XFazJsWV6FV4Mx:2bCzAyzHZdqtQX4236mVaNhK4Mx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4576-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4576-26-0x0000000000400000-0x000000000041E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads