Analysis
- max time kernel
26s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
28 signatures
150 seconds
General
- Target 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe
- Size 111KB
- Sample240613-h34nlayflc
- SHA256 9fc5d7feb266c4c6299881160168a49410136d12a28e1eafd13b02b1c65b8dde
- MD5 689f2429f487490ae6174f4b46bcba10
- SHA1 bf19586720f5af2b0228c7a32237079c45f7db0c
- SHA512 b4d76f1cd54cafebce529b8c9562c86512d02749209a357e550803f3df592266b875996e2a4d45fb315b9f384a0a723fe5d2fd2c9a483f84cc99a2efd1fdb268
- SSDEEP 1536:umpO1Ek93yAgf9vyVnuLSLfVYmCvMGC7mZDwJJTtJMGpC+xdTvi6rVbEDmpOE:1kAbf4dvL7C/KcD2JzpRXvLVbI9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies WinLogon for persistence 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\TuxO64747Z.exe\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M46840\\Ja67831bLay.com\"" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\TuxO64747Z.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M46840\\Ja67831bLay.com\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\O64747Z\\TuxO64747Z.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe , \"C:\\Windows\\M46840\\Ja67831bLay.com\"" smss.exe - Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" service.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" service.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" service.exe - Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" EmangEloh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" service.exe - Disables RegEdit via registry modification 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" EmangEloh.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe - Sets file execution options in registry 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\notepad.exe" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe winlogon.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe - Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd service.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd smss.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd EmangEloh.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd winlogon.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\sql.cmd 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe - Executes dropped EXE 4 IoCs
pid Process 3964 service.exe 4012 smss.exe 5112 EmangEloh.exe 2920 winlogon.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/5092-1-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-3-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-22-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-55-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-62-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-13-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-5-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-139-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-165-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5092-140-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/3964-250-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-254-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-252-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-258-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-257-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-253-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-260-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-256-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-255-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-259-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-284-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-285-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-290-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-301-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-302-0x0000000002FA0000-0x000000000405A000-memory.dmp upx behavioral2/memory/3964-304-0x0000000002FA0000-0x000000000405A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" service.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" service.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T47Z274 = "C:\\Windows\\sa-865388.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1468388TT4 = "C:\\Windows\\system32\\227487655073l.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T47Z274 = "C:\\Windows\\sa-865388.exe" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1468388TT4 = "C:\\Windows\\system32\\227487655073l.exe" EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\T47Z274 = "C:\\Windows\\sa-865388.exe" EmangEloh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\T1468388TT4 = "C:\\Windows\\system32\\227487655073l.exe" winlogon.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" service.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: EmangEloh.exe File opened (read-only) \??\i: winlogon.exe File opened (read-only) \??\u: winlogon.exe File opened (read-only) \??\p: smss.exe File opened (read-only) \??\t: smss.exe File opened (read-only) \??\y: smss.exe File opened (read-only) \??\s: EmangEloh.exe File opened (read-only) \??\m: smss.exe File opened (read-only) \??\j: winlogon.exe File opened (read-only) \??\N: winlogon.exe File opened (read-only) \??\o: smss.exe File opened (read-only) \??\e: EmangEloh.exe File opened (read-only) \??\r: winlogon.exe File opened (read-only) \??\E: service.exe File opened (read-only) \??\r: smss.exe File opened (read-only) \??\m: winlogon.exe File opened (read-only) \??\p: EmangEloh.exe File opened (read-only) \??\y: EmangEloh.exe File opened (read-only) \??\v: winlogon.exe File opened (read-only) \??\w: winlogon.exe File opened (read-only) \??\l: EmangEloh.exe File opened (read-only) \??\z: EmangEloh.exe File opened (read-only) \??\g: winlogon.exe File opened (read-only) \??\s: winlogon.exe File opened (read-only) \??\k: smss.exe File opened (read-only) \??\l: smss.exe File opened (read-only) \??\h: EmangEloh.exe File opened (read-only) \??\i: EmangEloh.exe File opened (read-only) \??\p: winlogon.exe File opened (read-only) \??\z: winlogon.exe File opened (read-only) \??\s: smss.exe File opened (read-only) \??\x: smss.exe File opened (read-only) \??\z: smss.exe File opened (read-only) \??\N: EmangEloh.exe File opened (read-only) \??\i: smss.exe File opened (read-only) \??\v: smss.exe File opened (read-only) \??\h: winlogon.exe File opened (read-only) \??\j: EmangEloh.exe File opened (read-only) \??\w: EmangEloh.exe File opened (read-only) \??\t: winlogon.exe File opened (read-only) \??\x: winlogon.exe File opened (read-only) \??\H: service.exe File opened (read-only) \??\N: smss.exe File opened (read-only) \??\l: winlogon.exe File opened (read-only) \??\q: winlogon.exe File opened (read-only) \??\y: winlogon.exe File opened (read-only) \??\K: service.exe File opened (read-only) \??\k: EmangEloh.exe File opened (read-only) \??\m: EmangEloh.exe File opened (read-only) \??\t: EmangEloh.exe File opened (read-only) \??\G: service.exe File opened (read-only) \??\q: EmangEloh.exe File opened (read-only) \??\r: EmangEloh.exe File opened (read-only) \??\x: EmangEloh.exe File opened (read-only) \??\k: winlogon.exe File opened (read-only) \??\e: smss.exe File opened (read-only) \??\g: smss.exe File opened (read-only) \??\q: smss.exe File opened (read-only) \??\u: smss.exe File opened (read-only) \??\e: winlogon.exe File opened (read-only) \??\h: smss.exe File opened (read-only) \??\w: smss.exe File opened (read-only) \??\g: EmangEloh.exe File opened (read-only) \??\o: EmangEloh.exe - Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\227487655073l.exe 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File created C:\Windows\SysWOW64\227487655073l.exe service.exe File created C:\Windows\SysWOW64\227487655073l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\X61345go\Z227487cie.cmd winlogon.exe File created C:\Windows\SysWOW64\227487655073l.exe winlogon.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Data DosenKu .exe service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File created C:\Windows\SysWOW64\X61345go\Z227487cie.cmd 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Lagu - Server .scr service.exe File opened for modification C:\Windows\SysWOW64\227487655073l.exe EmangEloh.exe File opened for modification C:\Windows\SysWOW64\227487655073l.exe winlogon.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\Titip Folder Jangan DiHapus .exe service.exe File opened for modification C:\Windows\SysWOW64\X61345go\Z227487cie.cmd smss.exe File opened for modification C:\Windows\SysWOW64\X61345go\Z227487cie.cmd EmangEloh.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\Lagu - Server .scr service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\TutoriaL HAcking .exe service.exe File opened for modification C:\Windows\SysWOW64\227487655073l.exe smss.exe File opened for modification C:\Windows\SysWOW64\X61345go\Z227487cie.cmd service.exe File created C:\Windows\SysWOW64\227487655073l.exe smss.exe File opened for modification \??\c:\Windows\SysWOW64\IME\SHARED\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\TutoriaL HAcking .exe service.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\TutoriaL HAcking .exe service.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll EmangEloh.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\SysWOW64\IME\SHARED\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\TutoriaL HAcking .exe service.exe File created C:\Windows\SysWOW64\227487655073l.exe 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\227487655073l.exe service.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\Data DosenKu .exe service.exe - Drops file in Program Files directory 27 IoCs
description ioc Process File created \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Data DosenKu .exe service.exe File created \??\c:\Program Files\Common Files\microsoft shared\Norman virus Control 5.18 .exe service.exe File opened for modification \??\c:\Program Files\Windows Sidebar\Shared Gadgets\Data DosenKu .exe service.exe File created \??\c:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Blink 182 .exe service.exe File created \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Vista setup .scr service.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Vista setup .scr service.exe File created \??\c:\Program Files (x86)\Google\Update\Download\TutoriaL HAcking .exe service.exe File created \??\c:\Program Files\dotnet\shared\Lagu - Server .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\Lagu - Server .scr service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Gallery .scr service.exe File created \??\c:\Program Files\Microsoft Office\Updates\Download\Windows Vista setup .scr service.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Love Song .scr service.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\Love Song .scr service.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\TutoriaL HAcking .exe service.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Norman virus Control 5.18 .exe service.exe File opened for modification \??\c:\Program Files\dotnet\shared\Lagu - Server .scr service.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\TutoriaL HAcking .exe service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\RaHasIA .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\RaHasIA .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\Updates\Download\Windows Vista setup .scr service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\Lagu - Server .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Gallery .scr service.exe File created \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Lagu - Server .scr service.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Blink 182 .exe service.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\TutoriaL HAcking .exe service.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Lagu - Server .scr service.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\M46840\EmangEloh.exe 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File created C:\Windows\Ti655073ta.exe service.exe File opened for modification C:\Windows\Ti655073ta.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\Gallery .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\THe Best Ungu .scr service.exe File opened for modification C:\Windows\SYSTEM.INI 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\Gallery .scr service.exe File opened for modification C:\Windows\Ti655073ta.exe EmangEloh.exe File opened for modification \??\c:\Windows\ServiceProfiles\LocalService\Downloads\Data DosenKu .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\Lagu - Server .scr service.exe File opened for modification C:\Windows\M46840 smss.exe File opened for modification C:\Windows\sa-865388.exe smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\Data DosenKu .exe service.exe File opened for modification C:\Windows\M46840\EmangEloh.exe smss.exe File created \??\c:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\THe Best Ungu .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\Titip Folder Jangan DiHapus .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\THe Best Ungu .scr service.exe File created C:\Windows\M46840\Ja67831bLay.com winlogon.exe File opened for modification C:\Windows\sa-865388.exe EmangEloh.exe File opened for modification C:\Windows\Ti655073ta.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\RaHasIA .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\Lagu - Server .scr service.exe File opened for modification \??\c:\Windows\ServiceProfiles\NetworkService\Downloads\RaHasIA .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\Norman virus Control 5.18 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\New mp3 BaraT !! .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\Love Song .scr service.exe File opened for modification C:\Windows\system\msvbvm60.dll smss.exe File created C:\Windows\sa-865388.exe service.exe File opened for modification \??\c:\Windows\Downloaded Program Files\TutoriaL HAcking .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\Gallery .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\TutoriaL HAcking .exe service.exe File created C:\Windows\M46840\smss.exe 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File created C:\Windows\M46840\smss.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\TutoriaL HAcking .exe service.exe File created C:\Windows\e574b90 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe File opened for modification C:\Windows\system\msvbvm60.dll service.exe File opened for modification C:\Windows\M46840\EmangEloh.exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\Love Song .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\RaHasIA .exe service.exe File created C:\Windows\system\msvbvm60.dll smss.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\RaHasIA .exe service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\Blink 182 .exe service.exe File created C:\Windows\M46840\EmangEloh.exe smss.exe File opened for modification \??\c:\Windows\SystemResources\Windows.ShellCommon.SharedResources\Gallery .scr service.exe File opened for modification C:\Windows\M46840 winlogon.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\Blink 182 .exe service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\Gallery .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\Windows Vista setup .scr service.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\Lagu - Server .scr service.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\RaHasIA .exe service.exe File created C:\Windows\sa-865388.exe winlogon.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\Windows Vista setup .scr service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" smss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EmangEloh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" EmangEloh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 3964 service.exe 3964 service.exe 3964 service.exe 3964 service.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Token: SeDebugPrivilege 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 3964 service.exe 4012 smss.exe 5112 EmangEloh.exe 2920 winlogon.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 5092 wrote to memory of 772 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 8 PID 5092 wrote to memory of 776 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 9 PID 5092 wrote to memory of 380 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 13 PID 5092 wrote to memory of 2620 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 44 PID 5092 wrote to memory of 2656 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 45 PID 5092 wrote to memory of 2904 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 52 PID 5092 wrote to memory of 3504 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 56 PID 5092 wrote to memory of 3664 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 57 PID 5092 wrote to memory of 3856 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 58 PID 5092 wrote to memory of 3952 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 59 PID 5092 wrote to memory of 4016 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 60 PID 5092 wrote to memory of 4092 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 61 PID 5092 wrote to memory of 4132 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 62 PID 5092 wrote to memory of 336 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 64 PID 5092 wrote to memory of 4488 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 76 PID 5092 wrote to memory of 3964 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 83 PID 5092 wrote to memory of 3964 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 83 PID 5092 wrote to memory of 3964 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 83 PID 5092 wrote to memory of 4012 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 84 PID 5092 wrote to memory of 4012 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 84 PID 5092 wrote to memory of 4012 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 84 PID 5092 wrote to memory of 5112 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 85 PID 5092 wrote to memory of 5112 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 85 PID 5092 wrote to memory of 5112 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 85 PID 5092 wrote to memory of 2920 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 86 PID 5092 wrote to memory of 2920 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 86 PID 5092 wrote to memory of 2920 5092 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe 86 PID 3964 wrote to memory of 772 3964 service.exe 8 PID 3964 wrote to memory of 776 3964 service.exe 9 PID 3964 wrote to memory of 380 3964 service.exe 13 PID 3964 wrote to memory of 2620 3964 service.exe 44 PID 3964 wrote to memory of 2656 3964 service.exe 45 PID 3964 wrote to memory of 2904 3964 service.exe 52 PID 3964 wrote to memory of 3504 3964 service.exe 56 PID 3964 wrote to memory of 3664 3964 service.exe 57 PID 3964 wrote to memory of 3856 3964 service.exe 58 PID 3964 wrote to memory of 3952 3964 service.exe 59 PID 3964 wrote to memory of 4016 3964 service.exe 60 PID 3964 wrote to memory of 4092 3964 service.exe 61 PID 3964 wrote to memory of 4132 3964 service.exe 62 PID 3964 wrote to memory of 336 3964 service.exe 64 PID 3964 wrote to memory of 4488 3964 service.exe 76 PID 3964 wrote to memory of 4012 3964 service.exe 84 PID 3964 wrote to memory of 4012 3964 service.exe 84 PID 3964 wrote to memory of 5112 3964 service.exe 85 PID 3964 wrote to memory of 5112 3964 service.exe 85 PID 3964 wrote to memory of 2920 3964 service.exe 86 PID 3964 wrote to memory of 2920 3964 service.exe 86 PID 3964 wrote to memory of 772 3964 service.exe 8 PID 3964 wrote to memory of 776 3964 service.exe 9 PID 3964 wrote to memory of 380 3964 service.exe 13 PID 3964 wrote to memory of 2620 3964 service.exe 44 PID 3964 wrote to memory of 2656 3964 service.exe 45 PID 3964 wrote to memory of 2904 3964 service.exe 52 PID 3964 wrote to memory of 3504 3964 service.exe 56 PID 3964 wrote to memory of 3664 3964 service.exe 57 PID 3964 wrote to memory of 3856 3964 service.exe 58 PID 3964 wrote to memory of 3952 3964 service.exe 59 PID 3964 wrote to memory of 4016 3964 service.exe 60 PID 3964 wrote to memory of 4092 3964 service.exe 61 PID 3964 wrote to memory of 4132 3964 service.exe 62 PID 3964 wrote to memory of 336 3964 service.exe 64 PID 3964 wrote to memory of 4488 3964 service.exe 76 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" service.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2656
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2904
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\689f2429f487490ae6174f4b46bcba10_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5092 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O64747Z\service.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O64747Z\service.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3964
-
-
C:\Windows\M46840\smss.exe"C:\Windows\M46840\smss.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4012
-
-
C:\Windows\M46840\EmangEloh.exe"C:\Windows\M46840\EmangEloh.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5112
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O64747Z\winlogon.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\O64747Z\winlogon.exe"3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3664
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3856
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4092
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4132
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:336
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4488
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1540
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:1552
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
3Modify Registry
10Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\M46840\EmangEloh.exe
- Size 111KB
- SHA256 9fc5d7feb266c4c6299881160168a49410136d12a28e1eafd13b02b1c65b8dde
- MD5 689f2429f487490ae6174f4b46bcba10
- SHA1 bf19586720f5af2b0228c7a32237079c45f7db0c
- SHA512 b4d76f1cd54cafebce529b8c9562c86512d02749209a357e550803f3df592266b875996e2a4d45fb315b9f384a0a723fe5d2fd2c9a483f84cc99a2efd1fdb268
- SSDEEP 1536:umpO1Ek93yAgf9vyVnuLSLfVYmCvMGC7mZDwJJTtJMGpC+xdTvi6rVbEDmpOE:1kAbf4dvL7C/KcD2JzpRXvLVbI9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 5581acdef90d13724f746c4fb6d0b3ce7913d2b3cbdf2176d59062a13f079873
- MD5 8c9594c994d7b7b6294cfd477010dd75
- SHA1 0ac9723c0a3d2602b0231cf6fc7a6f6d4488acb4
- SHA512 b11dae4f6485bb1d3296bfa44dc282125490116973c63edec4052aa0fdc201149b545cff27aa63c36547f7e49778bebf999159ac9fb4eebfbe2af8707f494ec3
- MD5 SHA1 SHA512
- Path C:\Windows\[TheMoonlight].txt
- Size 109B
- SHA256 883b19ec550f7ddb1e274a83d58d66c771ab10fefd136bab79483f2eb84e7fec
- MD5 68c7836c8ff19e87ca33a7959a2bdff5
- SHA1 cc5d0205bb71c10bbed22fe47e59b1f6817daab7
- SHA512 3656005148788ed7ac8f5b5f8f6f4736c2dc4a94771291170e61666beb81e63be2a1a0f2913233b0e3f12ddfa7f1e89da9cd8323306413395ee78b2ece7fbfe8
- MD5 SHA1 SHA512
- Path C:\Windows\system\msvbvm60.dll
- Size 1.4MB
- SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
- MD5 25f62c02619174b35851b0e0455b3d94
- SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
- SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
- SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\qgcl.pif
- Size 97KB
- SHA256 2e4d4f65fbcd10dfe4e3797cf75f0bee75080663297b94372568a7e8d0fd76fa
- MD5 f49988849532f902b2ff2e368d809650
- SHA1 d3c7e864f1b38c93a77272143743854efe531eae
- SHA512 9ada69441ceb8a5eec94696ee97d2a065b5b92f86d87a6c56e4ff029acdf7a3d65fbdc7acf19eccab984f4b44c8ec380b2345c29557c9aaa229011072c9b3bac
- SSDEEP 1536:7BHQZVCfhtvO1yc+dkGwje+jufA1l6bWtGVgOD9x/wjLohzG:7Bo+TvO9/jGgLgxGLo
- MD5 SHA1 SHA512 SSDEEP