Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe
- Size 718KB
- Sample240614-b57ppsthrl
- SHA256 2a43f837549dfa4e4f9c9dffbda1def7d9f2380fa0097f9d48da80a174b086b9
- MD5 9851b473a7309da131862a7bce3067e0
- SHA1 06439c93d710a9fa9a6efa3824776ad625ef1803
- SHA512 f0a438ef0de28bcb8cc9239881fde2cd55f2453736b8d2e42f4d45fd3277ce84f65aa913057e86f7a702e2ec8b63fb7330624d9483da0db39161f32a6358b442
- SSDEEP 12288:lP45SAMc2czNMke2zKy3T9MeXTCX0l/9ASf1hjsR/nQdKEKQqtfBGn:lQxn2qNrD3T95XBl/NJsR/+3Khin
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe - Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\pathx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe" 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ntos.exe 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5 PID 460 wrote to memory of 628 460 9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe 5
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9851b473a7309da131862a7bce3067e0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460