2ec2060b1ccc60f75f8223110fc7ea1739c68e402847230d5d519d4596c8f3db

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
Size 65KB
Sample240614-c8b8mssdph
SHA256 2ec2060b1ccc60f75f8223110fc7ea1739c68e402847230d5d519d4596c8f3db
MD5 9c358170ad200b520d22458ecd8a9cd0
SHA1 9948614bc4b957b6c5d506a1876cac01aa7fa1a1
SHA512 214c380257316e21dfa7d01da508e531a654af11a09a5529b4925b31587399d4111c388e29f4d853443833fe676be738fb502fe6b84f51c85ddcdbad3011546a
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oux:7WNqkOJWmo1HpM0MkTUmux
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2456	explorer.exe
4496	spoolsv.exe
1672	svchost.exe
1968	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
2456	explorer.exe
2456	explorer.exe
2456	explorer.exe
2456	explorer.exe
2456	explorer.exe
2456	explorer.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
1672	svchost.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
1672	svchost.exe
2456	explorer.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
1672	svchost.exe
2456	explorer.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
1672	svchost.exe
2456	explorer.exe
2456	explorer.exe
2456	explorer.exe
1672	svchost.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe
2456	explorer.exe
2456	explorer.exe
1672	svchost.exe
1672	svchost.exe
2456	explorer.exe
1672	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2456	explorer.exe
1672	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
2456	explorer.exe
2456	explorer.exe
4496	spoolsv.exe
4496	spoolsv.exe
1672	svchost.exe
1672	svchost.exe
1968	spoolsv.exe
1968	spoolsv.exe
2456	explorer.exe
2456	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 2456	324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	82
PID 324 wrote to memory of 2456	324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	82
PID 324 wrote to memory of 2456	324	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 4496	2456	explorer.exe	84
PID 2456 wrote to memory of 4496	2456	explorer.exe	84
PID 2456 wrote to memory of 4496	2456	explorer.exe	84
PID 4496 wrote to memory of 1672	4496	spoolsv.exe	85
PID 4496 wrote to memory of 1672	4496	spoolsv.exe	85
PID 4496 wrote to memory of 1672	4496	spoolsv.exe	85
PID 1672 wrote to memory of 1968	1672	svchost.exe	86
PID 1672 wrote to memory of 1968	1672	svchost.exe	86
PID 1672 wrote to memory of 1968	1672	svchost.exe	86
PID 1672 wrote to memory of 376	1672	svchost.exe	88
PID 1672 wrote to memory of 376	1672	svchost.exe	88
PID 1672 wrote to memory of 376	1672	svchost.exe	88
PID 1672 wrote to memory of 832	1672	svchost.exe	94
PID 1672 wrote to memory of 832	1672	svchost.exe	94
PID 1672 wrote to memory of 832	1672	svchost.exe	94
PID 1672 wrote to memory of 2440	1672	svchost.exe	96
PID 1672 wrote to memory of 2440	1672	svchost.exe	96
PID 1672 wrote to memory of 2440	1672	svchost.exe	96

C:\Users\Admin\AppData\Local\Temp\9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:324
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:376
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:832
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 0db7ebceb728e9e30df7c39efcf13b01797b12d11aa8b6b7fe76e72cb25d97db
MD5 69c596da5454ed7179ab852d23ea1115
SHA1 405f2199cb463aeff950f3f92634a70792d99529
SHA512 758bb56e76ce9d2a359e72affc910a8797df91d9a9c2f6bc3ba5962924eeb914db116d870353db18bd75948c65810fcaae0e341cd6fcf128bf72343271eda7cb
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuE:7WNqkOJWmo1HpM0MkTUmuE
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 cad34358162b6d9492e821d96f7fe603abd01e5568989950cdd1fb5a92a010ea
MD5 d16ecfee551ee49df23ffa1c60b2c79f
SHA1 4fed142f966acb8b5451b20c0975bacceeba62da
SHA512 f3852a489ddc66368b813fcbabd2f38379850e1e152a4d43da09668af1b0045ff4c57def673e250c4ff3ea319b088ab0133430d35c4d34f1c403a428ca2ff40c
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuF:7WNqkOJWmo1HpM0MkTUmuF
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 242a98bf122293f31879c294a18819185c30957d464a9eecda7fac5f7be32f3f
MD5 bd388a77fa7cc8269f7db5e76bd3fb1c
SHA1 75c827e941f8b35873fdd888f980bcfaa7c8ac5a
SHA512 e876718457e4cbb8d9c219cf65295f2e38339db3622af0b3499c53b00e3cd64820401b6710f7a9c691b036a37dbaae3c4809c06ffaa194e4442fb5b05c7ef9ba
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ous:7WNqkOJWmo1HpM0MkTUmus
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 7a8befd96379a8b2c4501bd757ec41ab7b241ddbbd8962bb10893bdad3115088
MD5 ae931a73f019605002be2fc338b50ac3
SHA1 728663082f4687ccf84a4d49b0dcaa0733a360ff
SHA512 897911edc61bf783e09a237e79bb80ac1c3c4edd7ff2c4ac529c53cccd4577a365775f8a577c5cf955f0904b71f0f3453b9822856cfd8689be40faa80e91c7a3
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuJ:7WNqkOJWmo1HpM0MkTUmuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/324-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/324-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/324-2-0x0000000075330000-0x000000007548D000-memory.dmp

Download

memory/324-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/324-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/324-55-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1672-35-0x0000000075330000-0x000000007548D000-memory.dmp

Download

memory/1672-39-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1672-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1968-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1968-43-0x0000000075330000-0x000000007548D000-memory.dmp

Download

memory/1968-48-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2456-13-0x0000000075330000-0x000000007548D000-memory.dmp

Download

memory/2456-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2456-68-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2456-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4496-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4496-25-0x0000000075330000-0x000000007548D000-memory.dmp

Download

memory/4496-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download