Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 12:16

General

  • Target

    7b7c9655d9ff06f48b0371dd2aa23430_NeikiAnalytics.exe

  • Size

    3.6MB

  • MD5

    7b7c9655d9ff06f48b0371dd2aa23430

  • SHA1

    0c30bffeebaaa53ccb198d4b6089ef89da198e2d

  • SHA256

    51f9aef5eaa835383a5798e92ef00a323580b466e50a916822c4f74c5ffdef15

  • SHA512

    275e2d907647d7f3ad47e14c8f9a475927a1c6a7af647b392aef2af87cde329d2168525430730a38c52cba3ef32b266483916582b812f6d777b6c3677f8edc2f

  • SSDEEP

    98304:ddByXcdnlLwOrI5Vfeg91hZOhkRpsinjR:ddien+OrFuBR6cR

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b7c9655d9ff06f48b0371dd2aa23430_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7b7c9655d9ff06f48b0371dd2aa23430_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4788
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2984
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4860
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2064
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:3188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe

    Filesize

    3.6MB

    MD5

    e4719bf14fa49819c2a41e14e68c357d

    SHA1

    9f6f6cfd537b7e82552f5de8d9b667f823eedfe7

    SHA256

    5baa9eb7ed86e821f4ebae3c9313fdaa3d48f3177c7cd5b56e8c32d38c56634d

    SHA512

    62f602e30c95ac998c98b91f2d703daa6cbe73399caf77af6ab75d8db8f0b07be5502ef4fdd692040a8c87a74783bc0f8c89195d8a641693ab54f353eaf2ac9a

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    3.6MB

    MD5

    4c8669ca467c3f5e7da0bd3573f71cda

    SHA1

    c73888373976f81f873055ab7fc4e65cc3ccd28b

    SHA256

    80baa4a60875fd8ce08c28068fd9480f06d4bf0a257a748b9d0a1898b842dfb0

    SHA512

    a2be5bdefddd47c94ce8ef917a534bdaf11f6ae7b5bfae53850b5995463e489176ece3346ba8168981adb2aed1f8b68834d4c98c516d7a21ec6d53a5a5cd2d6f

  • C:\Windows\Resources\svchost.exe

    Filesize

    3.6MB

    MD5

    8b018940ea2b39eec68d691030ec9a79

    SHA1

    fc65ba91781f46f660504ad60978e14d3fb83518

    SHA256

    cdef8d7248e3eaa8dbade68eecd85cbacb56a4c973565125298dd9f70a5d4ce8

    SHA512

    fc4c46cd690064c5aeb00a4f49d1de286e86668b417712a4028ef00b0c968d0248132696e28215b322d9e7d38ae46cd7ae378071d28b31492b011178531adcea

  • memory/2064-63-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-59-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-67-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-71-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-65-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-49-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-61-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-69-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-57-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-43-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-55-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-53-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-46-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-47-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2064-51-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-50-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-60-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-70-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-52-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-45-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-54-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-44-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-56-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-42-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-58-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-68-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-48-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-66-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-62-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/2984-64-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/3188-37-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/3188-32-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/4788-41-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/4788-1-0x0000000077472000-0x0000000077473000-memory.dmp

    Filesize

    4KB

  • memory/4788-0-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/4788-2-0x0000000077473000-0x0000000077474000-memory.dmp

    Filesize

    4KB

  • memory/4860-19-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB

  • memory/4860-40-0x0000000000400000-0x0000000000784000-memory.dmp

    Filesize

    3.5MB