b24a7a6092aec89af83fbdc032bd3155fb4a3ead51280302f7dc18096bfc532d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
Size 65KB
Sample240614-ephmesycnk
SHA256 b24a7a6092aec89af83fbdc032bd3155fb4a3ead51280302f7dc18096bfc532d
MD5 a100dab8e010174b8a7a5f28cbf42f50
SHA1 3b4214a879620614a9922fb33cbf1966bbcc2933
SHA512 3552a5d61e7bb990b624a0cd58604c72860033f37473b7de47394c3396b806ce6c1928c84c92fa04b0f8a5e46d1d251214d4762bb0ec3ae095b07b2812ad0ef1
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuE:7WNqkOJWmo1HpM0MkTUmuE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2948	explorer.exe
2712	spoolsv.exe
1324	svchost.exe
2736	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
2948	explorer.exe
2948	explorer.exe
2948	explorer.exe
2948	explorer.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe
2948	explorer.exe
2948	explorer.exe
1324	svchost.exe
1324	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2948	explorer.exe
1324	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
2948	explorer.exe
2948	explorer.exe
2712	spoolsv.exe
2712	spoolsv.exe
1324	svchost.exe
1324	svchost.exe
2736	spoolsv.exe
2736	spoolsv.exe
2948	explorer.exe
2948	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2948	1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe	82
PID 1152 wrote to memory of 2948	1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe	82
PID 1152 wrote to memory of 2948	1152	a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe	82
PID 2948 wrote to memory of 2712	2948	explorer.exe	83
PID 2948 wrote to memory of 2712	2948	explorer.exe	83
PID 2948 wrote to memory of 2712	2948	explorer.exe	83
PID 2712 wrote to memory of 1324	2712	spoolsv.exe	85
PID 2712 wrote to memory of 1324	2712	spoolsv.exe	85
PID 2712 wrote to memory of 1324	2712	spoolsv.exe	85
PID 1324 wrote to memory of 2736	1324	svchost.exe	87
PID 1324 wrote to memory of 2736	1324	svchost.exe	87
PID 1324 wrote to memory of 2736	1324	svchost.exe	87
PID 1324 wrote to memory of 1360	1324	svchost.exe	89
PID 1324 wrote to memory of 1360	1324	svchost.exe	89
PID 1324 wrote to memory of 1360	1324	svchost.exe	89
PID 1324 wrote to memory of 4860	1324	svchost.exe	98
PID 1324 wrote to memory of 4860	1324	svchost.exe	98
PID 1324 wrote to memory of 4860	1324	svchost.exe	98
PID 1324 wrote to memory of 5108	1324	svchost.exe	100
PID 1324 wrote to memory of 5108	1324	svchost.exe	100
PID 1324 wrote to memory of 5108	1324	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a100dab8e010174b8a7a5f28cbf42f50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2948
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1360
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4860
    - - C:\Windows\SysWOW64\at.exe
        
        at 04:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 82b3d3c280801348cab821ee4ef9bf7d89a1ec3b90b9ed04eb8cf6e2f72d017f
MD5 bf42debb6d46a674cdfc4ac57c48aac3
SHA1 85d40c95362ea6e761f65b8d9b36304cd97a1a55
SHA512 79489354e63bdd5945cf769ab12a2fb0ea61780df1e6cdcfbf2a809d311a8cae0bf92bfcf0d19413ae90ae9ed7ea1c3bddb221bbdb4dff325ef5f0d1fec124b6
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouz:7WNqkOJWmo1HpM0MkTUmuz
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 3f269fee77a59cc09f7d94eca6f14ceeb7cafce20a8d059e85852cedb2f70514
MD5 6d7d7accc927785a34d62b92e2b6c149
SHA1 c6005ef5b8cceb1ce138cb3d5643f0bae2eaa779
SHA512 099f54aca0751692ad1ba48c17c76573f8f838ca775674cf49cc153d16800dc05bf6f2422ed27c8052e64f444ba80f9b3ecc8f2a936f7c433a6a0c98ec766012
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou+:7WNqkOJWmo1HpM0MkTUmu+
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 2499c4650ee4145554b5d12dd26d49ad3144ec5ea3642a904086b330e13f7196
MD5 724b274906f2187b840c322948f71c11
SHA1 049a85ba57cc803ec3a0b8b1090d2c4db7ac7060
SHA512 ceb22e0a915a170ca663764432a0fff85cbb84dffa7c04f074649fbe79ffeb5fdfcfcacd0e6e5cf329827b42ba2b1e00a581ed31c4a294eafa33445e6ac0763e
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouc:7WNqkOJWmo1HpM0MkTUmuc
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 65KB
SHA256 24214beb9caa33fe0f767ce8ad641f0f75d83b7b723e5664cfaa3fef0188b010
MD5 678a60e1878c650d233ac86b2f7c1a4b
SHA1 6c2fc0bcc00ccc201350268dac5040cceb2b709d
SHA512 898afa6dc13638e764581fe86028c37e1894c4329d71571811c25097007538197e47286c180db40b958c7b7b1be247add78ff0b7bfb96d5ae03c1d74151cf5b5
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuH:7WNqkOJWmo1HpM0MkTUmuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1152-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1152-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1152-56-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1152-2-0x00000000755A0000-0x00000000756FD000-memory.dmp

Download

memory/1152-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1152-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1152-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/1152-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1324-61-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1324-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1324-37-0x00000000755A0000-0x00000000756FD000-memory.dmp

Download

memory/2712-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2712-27-0x00000000755A0000-0x00000000756FD000-memory.dmp

Download

memory/2712-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2712-26-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2736-44-0x00000000755A0000-0x00000000756FD000-memory.dmp

Download

memory/2736-50-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2948-13-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2948-14-0x00000000755A0000-0x00000000756FD000-memory.dmp

Download

memory/2948-59-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2948-16-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2948-70-0x0000000000400000-0x0000000000431000-memory.dmp

Download