Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 02:12

General

  • Target

    9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    9a4c7160bfaf6f401fe670e344bb3d00

  • SHA1

    dd9dd1beb84afb4559ad5df79d2714e473dc54ca

  • SHA256

    de4eae0e14a9519efaca31ff237a2315607cd412b0c023c697514b7bf826366d

  • SHA512

    a07e362498750c843bc874a324e0dcf73ae06662b2cb8feb5c0e99916ef0c305b2fd163960817e7bf5246318ae94bd468e14ada21ac2eabd314c4b0fe19b4570

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXim:IeklMMYJhqezw/pXzH9im

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2000
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2516
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2636
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2412
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2444
          • C:\Windows\SysWOW64\at.exe
            at 02:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2548
            • C:\Windows\SysWOW64\at.exe
              at 02:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1624
              • C:\Windows\SysWOW64\at.exe
                at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:652

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          d3d29e127a86415c238c866d9c448bb5

          SHA1

          f552e92b8736940019827b87abe01e87e91cb022

          SHA256

          9626c2a5ae50883ba105c8f8a8acee7b6653b724961d000e901f25ef5c71ac08

          SHA512

          06c90e4b9a0ca1667f8f1e3deb7b5d30924ae8d21db16e57254a526e6cc796ce76c81b79c953cd9768eeae9bddad3f4bace9217e42c89f2a7a55e3e772e9bbf4

        • \Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          969a46fec143202e023fabd52637c9bc

          SHA1

          8d7c7f73c6db4468b6ea307519de971f7b01197d

          SHA256

          846e4b70d3ea2b1c88637bc8f60400fb52fa0abe841bf8e45ad8cd6682023c43

          SHA512

          9f793cf96aa8e121a966760d19d9135efa3b6da3c3b5293625e693bd9b3c37f3edf2c9a96af0693a9191c41c2c5badffb0ac8b61afdb0bbf003450f8226dc2f4

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          b3635b306f4817846bc8d84ff2610bda

          SHA1

          9f4bd2ef422d03dc0b517c14afe1d5796768db42

          SHA256

          baa9f437e445bdd958f669632147e7fc5b9d895908ac49fd235f686b01f61779

          SHA512

          443c224f2f66ebc1b39e25b9ab31a6221687cab2da189d2276807f122c7e873ab96b373135728f9959b944f4b8c108d37aa851130630e8beed995cd91bf732d0

        • \Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          714255d824e1e6c66095093eba286e03

          SHA1

          c05dde68b43a69680b92991a9b717b01d6c6ef78

          SHA256

          2fd69be63a3d1fadcc7e8db5b841672fc0537dbc9f94c6b30e6605df50a193ac

          SHA512

          086549cf19ced42582e6d102a53b75118bd025995c3b548a4502b9db80b3e31bcaea2dc855de188738be04cd3f8f04f6bbdf594af0b85686258d3252fc428687

        • memory/2000-19-0x0000000002870000-0x00000000028A1000-memory.dmp

          Filesize

          196KB

        • memory/2000-74-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2000-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2000-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2000-75-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2000-20-0x0000000002870000-0x00000000028A1000-memory.dmp

          Filesize

          196KB

        • memory/2000-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2000-76-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2000-5-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2000-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2412-80-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2412-52-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2412-58-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2412-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2444-63-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2444-68-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2516-21-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2516-17-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2516-78-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2516-89-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2636-72-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2636-35-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2636-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2636-36-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB