Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 12:14

General

  • Target

    7b514cbb5d3ab728d0f42524bcee1450_NeikiAnalytics.exe

  • Size

    69KB

  • MD5

    7b514cbb5d3ab728d0f42524bcee1450

  • SHA1

    0acafd7ed7db3c0834a4f0a7fc228adb8ed541bf

  • SHA256

    48407974e0003d9e8654531426efd9860dd89b3c165a45a9516060cc6b029902

  • SHA512

    2d71bc1329106933f50b15af4a7991336e51d35bdf140fe717b65009f30ce8713bbabe05266b0a0a95e0211233ab1796989248f5ac19981dbfce977cf80858f3

  • SSDEEP

    1536:EJrFDMRyriCY/qXfatMp4Q2V6fIMxIpLC:0F8dCY85TE6fIMSRC

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b514cbb5d3ab728d0f42524bcee1450_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7b514cbb5d3ab728d0f42524bcee1450_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1884
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2112
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2616
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2500
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2584
          • C:\Windows\SysWOW64\at.exe
            at 12:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2952
            • C:\Windows\SysWOW64\at.exe
              at 12:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:856
              • C:\Windows\SysWOW64\at.exe
                at 12:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:564

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          70KB

          MD5

          50713f422a2e768c7ea1459280591a63

          SHA1

          7c3f6cf6988f7710f5573ac480c90f9b31b4206c

          SHA256

          0c38da726c62b335f69d6623b8c7c38be598044455de303cd6b54c25d65bece9

          SHA512

          934313114339c94545bc3a5eed23d56596c36a3d42e1a45315b8edb2e59845035e547df271ec701c3fb568d6e30b1105fbef44e91a2cfd8159c5b0e87d1be92c

        • \Windows\system\explorer.exe

          Filesize

          69KB

          MD5

          754744f61d91a358fe664a40dfbfa1db

          SHA1

          60706306794695f58012412d3f2abbb607a77980

          SHA256

          6028ecb6a17286e3470fc055edb2c6efe15ae117919097d6b1b8d8738aa17ce1

          SHA512

          dc7980c0e2c0879880877d144ce1a3566b3b4154862f2d57b5da46704603a4f4644d8cffb78ccb7ec275e01df172fb846c96630341c17c5fb1dd31f422354b23

        • \Windows\system\spoolsv.exe

          Filesize

          69KB

          MD5

          b8f0b4954ac1d42635b5c0e30068887b

          SHA1

          e243a82b0232cfa4078f81032f4f7defab91d23e

          SHA256

          8ce12167cab6dc6f254ef154dfb5c75b8ad266e55f51485403d10b2ef482335d

          SHA512

          d8d9d11279da1160352a5851210befd4fe5959f31c79daaa11aa8bbb133b0c8d2a1e691e97df7cfa74e9988e182db68aafc8bcfb9c583b6b0af06c694322ba1c

        • \Windows\system\svchost.exe

          Filesize

          69KB

          MD5

          9ac708b0aaadc1779c0da2bdeddf15a4

          SHA1

          0092b2c9d84a5f5b412055b2a38d429f5afc8b10

          SHA256

          b545aad1f3ffd574977522d1762ed66937091c9dbd50d0c066893917b13a3417

          SHA512

          232b40c3c870d5ec5bd691bdd32904701f447ab5a9beb0d5c7cd3e08a35d3de1944105a342d8e8f4d09dc35ea8a5c7032f4a0cb06e2dc6d1a659608634f1c0fc

        • memory/1884-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/1884-12-0x0000000003280000-0x00000000032B4000-memory.dmp

          Filesize

          208KB

        • memory/1884-59-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2112-28-0x0000000002650000-0x0000000002684000-memory.dmp

          Filesize

          208KB

        • memory/2112-73-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2112-63-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2112-16-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2500-64-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2500-45-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2584-55-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2616-61-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/2616-29-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB