56f36684641bf10a757827a468557c14ec2b3667c6efdb917fd316bf36c5f641

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
Size 66KB
Sample240614-eekc9stgrb
SHA256 56f36684641bf10a757827a468557c14ec2b3667c6efdb917fd316bf36c5f641
MD5 9ffe3a6dd504f31bcd57d46ba22b0550
SHA1 4c0dc4a8b988ed0dd230afaa89fcd758cbaf7dc8
SHA512 88176d344b2823960b266f667d0dd79540ac5e7ab34629f57133401805c759fd195b2eab8922c16b9b3e12983bfc8ad59b0200ec98d881e9140d3a89b881e05e
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi6ffffffffffffffffffffe:IeklMMYJhqezw/pXzH9i6ffffffffffe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4292	explorer.exe
4336	spoolsv.exe
4244	svchost.exe
3468	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
4292	explorer.exe
4292	explorer.exe
4292	explorer.exe
4292	explorer.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe
4292	explorer.exe
4292	explorer.exe
4244	svchost.exe
4244	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4292	explorer.exe
4244	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
4292	explorer.exe
4292	explorer.exe
4336	spoolsv.exe
4336	spoolsv.exe
4244	svchost.exe
4244	svchost.exe
3468	spoolsv.exe
3468	spoolsv.exe
4292	explorer.exe
4292	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4292	3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	83
PID 3592 wrote to memory of 4292	3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	83
PID 3592 wrote to memory of 4292	3592	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	83
PID 4292 wrote to memory of 4336	4292	explorer.exe	85
PID 4292 wrote to memory of 4336	4292	explorer.exe	85
PID 4292 wrote to memory of 4336	4292	explorer.exe	85
PID 4336 wrote to memory of 4244	4336	spoolsv.exe	87
PID 4336 wrote to memory of 4244	4336	spoolsv.exe	87
PID 4336 wrote to memory of 4244	4336	spoolsv.exe	87
PID 4244 wrote to memory of 3468	4244	svchost.exe	88
PID 4244 wrote to memory of 3468	4244	svchost.exe	88
PID 4244 wrote to memory of 3468	4244	svchost.exe	88
PID 4244 wrote to memory of 552	4244	svchost.exe	89
PID 4244 wrote to memory of 552	4244	svchost.exe	89
PID 4244 wrote to memory of 552	4244	svchost.exe	89
PID 4244 wrote to memory of 2536	4244	svchost.exe	100
PID 4244 wrote to memory of 2536	4244	svchost.exe	100
PID 4244 wrote to memory of 2536	4244	svchost.exe	100
PID 4244 wrote to memory of 4512	4244	svchost.exe	102
PID 4244 wrote to memory of 4512	4244	svchost.exe	102
PID 4244 wrote to memory of 4512	4244	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4292
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:552
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2536
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 2191f98c974cbb6b0a7c5a49c04abb72d4f0a4c046c4452771c47ee9a1a17356
MD5 1106f7be7199b4371f4e063878c77eb2
SHA1 d8c696c2f5ec455117d6b4ef28b9215ab1fc59d6
SHA512 b3cd8b5bc775cb50c28a50347e1983b92399e3bf1d8484920344daf4a8163cf63d93fcb8506e01881267f1cad4d056ccce6b0dc45ea57a57a3a18fe6cc6f15b4
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXit:IeklMMYJhqezw/pXzH9it
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 66KB
SHA256 112a197dff901f28461e9a84c844ffcd5a6816849e000fc6b89dd121175c9b60
MD5 b1328d1ad884037e96fc8b986e92cb34
SHA1 ded6a21aeb291c8254d42befeaf45e7c50e2fb56
SHA512 4309c355c0e24c1276b6f4d3993100892163afd468ddc155e5d107680c0c6d5b1bbe25108078f23e5ccdfbda2a51315045f8308cdefa9308bf90ea9536004ed8
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiq:IeklMMYJhqezw/pXzH9iq
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 66KB
SHA256 1c142333b358ae80867f8d9a65a8286f980e9feeffa0a19ad4c569a08b66fecd
MD5 b83a32214a4820ffdbc1fcb0d8a54518
SHA1 31dd1a47c00ae1688674fb11b5f2dcda3c13a734
SHA512 74f9100adcc76f48e8d3125d50675634c1ce76c6878d5cbf2eafb9a49eefc76cd4465cec3767bb7ccfb8ff7e2d5eae09bfd95d02228c36c6681d14eed01728de
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXix:IeklMMYJhqezw/pXzH9ix
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 66KB
SHA256 bfc25bea856ffa3a170e24bff53e84c6072ace1f38b74adf3a385bb894ce5404
MD5 5c1ba85a43ffed90e9bab63d13942fcb
SHA1 490d560c8d9a87497f56a6323ed2ea3f1bd253f2
SHA512 30c313915000860025c56273cb6de8ef400b75181ec5ecd40e5389ec650fa69adcac8667ea244d001f566eaeca35828b57d3d6d7a97d641cf625771fd5269014
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiP:IeklMMYJhqezw/pXzH9iP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3468-44-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3468-51-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3468-45-0x0000000074D70000-0x0000000074ECD000-memory.dmp

Download

memory/3592-5-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3592-58-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3592-57-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3592-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3592-2-0x0000000074D70000-0x0000000074ECD000-memory.dmp

Download

memory/3592-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3592-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/4244-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4244-37-0x0000000074D70000-0x0000000074ECD000-memory.dmp

Download

memory/4244-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4292-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4292-18-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4292-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4292-14-0x0000000074D70000-0x0000000074ECD000-memory.dmp

Download

memory/4292-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4336-30-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4336-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4336-26-0x0000000074D70000-0x0000000074ECD000-memory.dmp

Download

memory/4336-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download