ab45df3398f7c16bb2d75a18cb06b860ed7c2c558bdae5ae6cd80f7f8b2ae646

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
Size 66KB
Sample240613-kywhjasbld
SHA256 ab45df3398f7c16bb2d75a18cb06b860ed7c2c558bdae5ae6cd80f7f8b2ae646
MD5 6ee6c920342531dfff6f4b69b72ce6b0
SHA1 fafa311e775a3f022c10baa5e3c7b428539c2ca1
SHA512 3d6f3fc4c405c6f9ddfb5e1eb9193fa91c946d49e4bc6a486e875b65aaa59c75ff40335f3b2f643a08bd140e2a67bd397252e4ba936a854310ca2159083d7503
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXih:IeklMMYJhqezw/pXzH9ih
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3764	explorer.exe
3424	spoolsv.exe
4548	svchost.exe
1204	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe
3764	explorer.exe
3764	explorer.exe
4548	svchost.exe
4548	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3764	explorer.exe
4548	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
3764	explorer.exe
3764	explorer.exe
3424	spoolsv.exe
3424	spoolsv.exe
4548	svchost.exe
4548	svchost.exe
1204	spoolsv.exe
1204	spoolsv.exe
3764	explorer.exe
3764	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 3764	232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe	81
PID 232 wrote to memory of 3764	232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe	81
PID 232 wrote to memory of 3764	232	6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe	81
PID 3764 wrote to memory of 3424	3764	explorer.exe	83
PID 3764 wrote to memory of 3424	3764	explorer.exe	83
PID 3764 wrote to memory of 3424	3764	explorer.exe	83
PID 3424 wrote to memory of 4548	3424	spoolsv.exe	84
PID 3424 wrote to memory of 4548	3424	spoolsv.exe	84
PID 3424 wrote to memory of 4548	3424	spoolsv.exe	84
PID 4548 wrote to memory of 1204	4548	svchost.exe	86
PID 4548 wrote to memory of 1204	4548	svchost.exe	86
PID 4548 wrote to memory of 1204	4548	svchost.exe	86
PID 4548 wrote to memory of 1220	4548	svchost.exe	88
PID 4548 wrote to memory of 1220	4548	svchost.exe	88
PID 4548 wrote to memory of 1220	4548	svchost.exe	88
PID 4548 wrote to memory of 736	4548	svchost.exe	98
PID 4548 wrote to memory of 736	4548	svchost.exe	98
PID 4548 wrote to memory of 736	4548	svchost.exe	98
PID 4548 wrote to memory of 544	4548	svchost.exe	100
PID 4548 wrote to memory of 544	4548	svchost.exe	100
PID 4548 wrote to memory of 544	4548	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6ee6c920342531dfff6f4b69b72ce6b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3764
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1220
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:736
    - - C:\Windows\SysWOW64\at.exe
        
        at 09:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 870f4f742eeefba142b57de7346384185d9358b7047ee044b09e4a43a7bbcfbe
MD5 45f70f966d050c5538365ce7903b5c19
SHA1 86b33dcacb31380d206d721cf393c0d599714b52
SHA512 c50c9fdccff23f323a65c5492041bd35c8673360c04bad217d26109af000094fa98056529ef1874f01a0979ab2287f806d5eb1b67b7a938d895ccd59131c4bdf
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiR:IeklMMYJhqezw/pXzH9iR
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 3f844becfa0b446bdcffe8be30956bfa9d7555bf65381e434733a2b4386c34b7
MD5 1477e7e36714f11947be695ecf6be815
SHA1 8724d8a42849c932dd4034cfedee7ca86ff3e367
SHA512 831bf981e7d48e4baa9ef6d510f16c921bbc6a03e6f90208fff64f1d990159fa5a497760438fde253f28c654ecd1b0ea5433717e5c7e5916e61e0996e3de2547
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiM:IeklMMYJhqezw/pXzH9iM
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 f33f815981de34e98e52b8695325640fd0cc4c887965256343683012e82640f8
MD5 2fbe9aae0987fb0f7af26708a6e25c18
SHA1 e93062c71ca9c7850f6dd01d97e3d627108bdceb
SHA512 db5e896725765b96ab16366f4cb5f44cc5fee1fa6f73f6703fbee9c3ae864b9fddbc7c31c896ffe5fb0605528b23c1940bfa17b25fc373953068e698ddea4ed3
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiL:IeklMMYJhqezw/pXzH9iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 66KB
SHA256 959b442b2d66e81080f15f73e0027930aaceac3e81b30a3683b874806530bbd8
MD5 beae1c89357955329a608e600ea6c395
SHA1 6b8a0b879354b761d2204e39530519a23af2061d
SHA512 749c149fa45c2ba0af562e213df67a6ddf6b1350576e70630b55ea10472bdc30793624c85ee36c5c34a71ba395a1535e1ec64da700b21cefd5925ce87d8d82d4
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXis:IeklMMYJhqezw/pXzH9is
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-56-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/232-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/232-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/232-2-0x0000000075840000-0x000000007599D000-memory.dmp

Download

memory/232-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/232-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/232-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1204-44-0x0000000075840000-0x000000007599D000-memory.dmp

Download

memory/1204-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1204-43-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3424-25-0x0000000075840000-0x000000007599D000-memory.dmp

Download

memory/3424-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3764-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3764-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3764-14-0x0000000075840000-0x000000007599D000-memory.dmp

Download

memory/3764-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3764-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4548-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4548-35-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4548-36-0x0000000075840000-0x000000007599D000-memory.dmp

Download

memory/4548-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download