Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 11:41
General
- Target 7906d1069592e0f7975432bdf343e980_NeikiAnalytics.dll
- Size 776KB
- Sample240613-nthyesxblh
- SHA256 478cf0c0a2912b4179b847b43fb3df04c967864ec1e58e50c84f4d07f98a4d71
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7906d1069592e0f7975432bdf343e980_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AppVShNotify.exeC:\Windows\system32\AppVShNotify.exe1⤵
-
C:\Windows\system32\secinit.exeC:\Windows\system32\secinit.exe1⤵
-
C:\Windows\system32\CustomInstallExec.exeC:\Windows\system32\CustomInstallExec.exe1⤵
-
C:\Windows\system32\browserexport.exeC:\Windows\system32\browserexport.exe1⤵
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\8WtRghG.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{472f5621-519e-5ebb-8b52-1dcab1a03463}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{472f5621-519e-5ebb-8b52-1dcab1a03463}"2⤵
-
-
C:\Windows\system32\changepk.exeC:\Windows\system32\changepk.exe1⤵
-
C:\Windows\system32\AssignedAccessGuard.exeC:\Windows\system32\AssignedAccessGuard.exe1⤵
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\33jazbf.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\0UW.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Tgkmcdynncbgbyt" /SC minute /MO 60 /TR "C:\Windows\system32\1052\OptionalFeatures.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
0UW.cmd
33jazbf.cmd
8WtRghG.cmd
D4C2D.tmp
xEI4A67.tmp
RecoveryDrive.exe
Fsnnuctyadbpkex.lnk
memory/748-0-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/748-2-0x0000020730A40000-0x0000020730A47000-memory.dmp
memory/748-5-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-18-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-10-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-23-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-21-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-20-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-19-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-42-0x0000000001370000-0x0000000001377000-memory.dmp
memory/3444-17-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-15-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-14-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-13-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-12-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-11-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-31-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-9-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-8-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-24-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-43-0x00007FFDF62C0000-0x00007FFDF62D0000-memory.dmp
memory/3444-40-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-22-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-52-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-7-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-16-0x0000000140000000-0x00000001400C2000-memory.dmp
memory/3444-6-0x00007FFDF45AA000-0x00007FFDF45AB000-memory.dmp
memory/3444-3-0x0000000003340000-0x0000000003341000-memory.dmp