Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 12:01

General

  • Target

    7a50e4f23bfa6c4e40be34d51e8ba750_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    7a50e4f23bfa6c4e40be34d51e8ba750

  • SHA1

    c61858b260d6d241ce749fedc7d2df91107a7d99

  • SHA256

    e3ad8d9c635a0e88990ed1252b7fb1729e6a25a9ce41c187df6b2e455b8d3ede

  • SHA512

    a01b220f4820689b0c123014f9736d93d115e75658d73fc74ce34c5d11afb35565726b97c83b755f27575555c783b33ad273bb2edb1249a19738aa8d75b85f4e

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXib:IeklMMYJhqezw/pXzH9ib

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a50e4f23bfa6c4e40be34d51e8ba750_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7a50e4f23bfa6c4e40be34d51e8ba750_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4556
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4828
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4468
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4544
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4572
          • C:\Windows\SysWOW64\at.exe
            at 12:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:3040
            • C:\Windows\SysWOW64\at.exe
              at 12:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:5108
              • C:\Windows\SysWOW64\at.exe
                at 12:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4292

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          de7834982484af112dfa450cdbac8100

          SHA1

          36c86c5726bbdcec009cda8cfc2c44afa2bc7923

          SHA256

          fd984b6702bbba77306aaa7199424e408a7b8af9aeeb25883c5b2b4919d9ccae

          SHA512

          9c144ca59f6205f5e58e7cae7d4b660adfeb7869e6f183f636d2b868e8c854929e9490e7c939ae284bb40d161f9cfa84e3e60dbec9c7d832ef1b04b5452517b3

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          c87d6bf805c2525f97e903cf0f234b13

          SHA1

          17d24bc5e0156922410ffa45e251d86ee66cac31

          SHA256

          83c45fe960afc4c00edfefb44c3c14dbaa39f84ed7e7e025e9f40719f4adf2c1

          SHA512

          cd6f341d6e5f4a007a3b8ed3e40928c23bd410f31f1956d78971529678f1e0c5942ba72513e8caf4a05215e47e587654f4781ff7983bc6c5b6cc9982d3013a48

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          2973407d42677054f3aecebaa1ce2851

          SHA1

          c1f0b3fa1b94dabce30cd2f90d8d0b82181dc08b

          SHA256

          db22d15d12d6f0c0e11f9a0c158a438c55ac84b2dd22d01373428325374eda75

          SHA512

          02954d4acd17989e270cbbd97fa9a5465a781ea30675d0211f76f29d3f016e8a94051bba557764a9a276772505f62d2bd2006be6d32d91c17e19ecbbf30c9144

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          aec6b2f4eb24954c9d9b65d97c848bde

          SHA1

          899cbfacf37786a535620ad09862f937c0a0f0a3

          SHA256

          2296bfd0c9698731d99001a5ec5c223877b986fbd22c447c4c87021419895f2a

          SHA512

          b100f87453293d61250442a4ab7ff6bad2d64f3a5dfce50be219def8d084f30b5d7cd780bb09769bc3f56cc5278d3141b58567d77247bbc84052f72e24cc921b

        • memory/4468-29-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4468-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4468-25-0x0000000075430000-0x000000007558D000-memory.dmp

          Filesize

          1.4MB

        • memory/4544-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4544-37-0x0000000075430000-0x000000007558D000-memory.dmp

          Filesize

          1.4MB

        • memory/4544-36-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4544-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4556-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4556-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4556-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4556-2-0x0000000075430000-0x000000007558D000-memory.dmp

          Filesize

          1.4MB

        • memory/4556-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4556-58-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4556-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/4572-51-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4572-44-0x0000000075430000-0x000000007558D000-memory.dmp

          Filesize

          1.4MB

        • memory/4572-47-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4828-18-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4828-14-0x0000000075430000-0x000000007558D000-memory.dmp

          Filesize

          1.4MB

        • memory/4828-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4828-13-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4828-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB