Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe
- Size 71KB
- Sample240614-dt777stbmd
- SHA256 a6c5a0caf5181c086963405c8488ce2169adb6f3707d7bcdcad118f2f3dba932
- MD5 9e342dc210b5f2e812ae8ceb6d7d2cc0
- SHA1 becd9ccc3cd852779bb7b5d66bffe1408924c6f5
- SHA512 ff31cbdef6247dbb110628af903a83dc73b9887f9332b0859c20047841bf7e06d4f8e78c090de6b1b4e765da1b212e1966df54bcd9bc832fe9a0811634d30850
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slvjKV:Olg35GTslA5t3/w8R
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" sradook-anoab.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{544D5541-4342-4c42-544D-554143424c42} sradook-anoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{544D5541-4342-4c42-544D-554143424c42}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{544D5541-4342-4c42-544D-554143424c42}\IsInstalled = "1" sradook-anoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{544D5541-4342-4c42-544D-554143424c42}\StubPath = "C:\\Windows\\system32\\uhxoasoap.exe" sradook-anoab.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe sradook-anoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" sradook-anoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouvmutoog-umeas.exe" sradook-anoab.exe - Executes dropped EXE 2 IoCs
pid Process 1792 sradook-anoab.exe 4412 sradook-anoab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" sradook-anoab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" sradook-anoab.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" sradook-anoab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} sradook-anoab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify sradook-anoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" sradook-anoab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eadneahig.dll" sradook-anoab.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ouvmutoog-umeas.exe sradook-anoab.exe File created C:\Windows\SysWOW64\uhxoasoap.exe sradook-anoab.exe File opened for modification C:\Windows\SysWOW64\eadneahig.dll sradook-anoab.exe File opened for modification C:\Windows\SysWOW64\sradook-anoab.exe sradook-anoab.exe File opened for modification C:\Windows\SysWOW64\sradook-anoab.exe 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\sradook-anoab.exe 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ouvmutoog-umeas.exe sradook-anoab.exe File opened for modification C:\Windows\SysWOW64\uhxoasoap.exe sradook-anoab.exe File created C:\Windows\SysWOW64\eadneahig.dll sradook-anoab.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 4412 sradook-anoab.exe 4412 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe 1792 sradook-anoab.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1848 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe Token: SeDebugPrivilege 1792 sradook-anoab.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1792 1848 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe 82 PID 1848 wrote to memory of 1792 1848 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe 82 PID 1848 wrote to memory of 1792 1848 9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe 82 PID 1792 wrote to memory of 616 1792 sradook-anoab.exe 5 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 4412 1792 sradook-anoab.exe 83 PID 1792 wrote to memory of 4412 1792 sradook-anoab.exe 83 PID 1792 wrote to memory of 4412 1792 sradook-anoab.exe 83 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56 PID 1792 wrote to memory of 3424 1792 sradook-anoab.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e342dc210b5f2e812ae8ceb6d7d2cc0_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\sradook-anoab.exe"C:\Windows\system32\sradook-anoab.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\sradook-anoab.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\eadneahig.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ouvmutoog-umeas.exe
- Size 74KB
- SHA256 4b8791e8f54f14d447992eeec0dd518b256dbf02190e48730852ab878a4efe1e
- MD5 0687634ad6c8d381ad0042d05bb1937a
- SHA1 842d23d60751749aeb8ed1cc7fbb68de5debf1b4
- SHA512 f9786c755d980db204895c9e9a479c0c7279db3efb8349107176911f39c5606b51c80c175ca701d75af0a936ccab08442eb6ba0f01ba5baaa7913f754a8e17b8
- SSDEEP 768:hZZ6Zyf9wIh3SDyA0BIy/jIx+TZjUPx80sxCOopBoRxZzq3Yy+gMqMXmDLHr+cSK:1ldDCxGZwPm0/p8xY3clZcsVAQDfhcv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sradook-anoab.exe
- Size 71KB
- SHA256 a6c5a0caf5181c086963405c8488ce2169adb6f3707d7bcdcad118f2f3dba932
- MD5 9e342dc210b5f2e812ae8ceb6d7d2cc0
- SHA1 becd9ccc3cd852779bb7b5d66bffe1408924c6f5
- SHA512 ff31cbdef6247dbb110628af903a83dc73b9887f9332b0859c20047841bf7e06d4f8e78c090de6b1b4e765da1b212e1966df54bcd9bc832fe9a0811634d30850
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slvjKV:Olg35GTslA5t3/w8R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\uhxoasoap.exe
- Size 73KB
- SHA256 7f0c8dda2ff2dbff4946b6b3e9dd4a169fcdd9af41002066cdf91629f4e3082e
- MD5 c6773424ce49b747108a6f731ffafe87
- SHA1 3178a71a8e8b59cf8c692d8fc17be384ac299409
- SHA512 70ee116edb648c812520eb771248288c4c61eab65b237f8cb6ef30b027b7d48e9b2409e516f5296e2272d6b2864d17553af4e2f925192deb80d93dda0fdcd52b
- SSDEEP 1536:xdpqGp9RWC6TuJqZb6GAFPpLdueBGhd+Y/uyGSZTi:fpqGzquJJGCpLQeQr3/uyhTi
- MD5 SHA1 SHA512 SSDEEP