Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 05:03

General

  • Target

    a45c75ee4ccf86cda5643524d14568b0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    a45c75ee4ccf86cda5643524d14568b0

  • SHA1

    c6d47b9d3fb6bb6fb9e2f93e5557aea6ec97e31a

  • SHA256

    6aef9ea370a7a355f11c5801112f7671918619837c6a42c91f62f7fea214d4e9

  • SHA512

    2a76877c034fcdaec22d4ce0592b9c200ebd0fc0b2feee1a67dba4183f98d094358a30107ac0cbf9b30b3ed07dfcd353be91dc7028fd602b215e879d90dcdb9c

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi7:IeklMMYJhqezw/pXzH9i7

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a45c75ee4ccf86cda5643524d14568b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a45c75ee4ccf86cda5643524d14568b0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2420
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2884
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2736
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2632
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2628
          • C:\Windows\SysWOW64\at.exe
            at 05:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1264
            • C:\Windows\SysWOW64\at.exe
              at 05:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1516
              • C:\Windows\SysWOW64\at.exe
                at 05:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1804

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          f6a501399be819d154c66f0cc4ea4039

          SHA1

          0e3a4aec758238998f461c5bb9fb8cd6f81b9168

          SHA256

          9d61d3901bf12fa303bf6f27380aebdb9af636760ada06c7aba90aa22acc50a4

          SHA512

          6f1d473aa06daac57c4102a2c25a25c989c277150cd0f2ae6c6022375a1afe69d8cc4d3b91d9e912ac34ef6ee3d7804cc44be228923b2fd805d8571734e47b3c

        • \Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          1be42895bf42472d71399d1395ea1347

          SHA1

          6c3591a06c88a2ca90e5e263e0ea2ec2c6d63f5f

          SHA256

          b15740969877a81fffab27cb22b062528f0db8310210f52c560338e7f2567b86

          SHA512

          1b3ff925c82b9ed0bdc1e065208fa093d7d57cd6717839b865f5e9a9c3bc5d3a85da7b6f52b95227f599b2007876b887429cfa80efddbd6ea52fb69869f62c92

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          ba1c7936e532f04d9f5b375062f1aaa5

          SHA1

          2a3131152e14252d1bc0013f08ac4d9a8c53d446

          SHA256

          427e09ec6ed366187cf703b29e933dadbd4d3a8e8a00301aa5d6af43a0f506bb

          SHA512

          f1287cec8c98d036bfd872b2bf2f93e63d2e82c91f9a910ae0111010c9f3682d6e1903baa9769e9e4a700962f1f36179d8f58c2b12081c7894bcd98656194cdb

        • \Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          ab6c11793fc57d260f15f28353dae216

          SHA1

          f4818cb1e9cd0561a54320fbb4d86ec8ec298ebf

          SHA256

          93a5aaab9a9e6ad37fecface1d87d23c7e3836f83b6954c6ff60024f14299c6b

          SHA512

          a48c8b99f8069ceb03e44e385dbf5826373e5c78dfc2c9c6291f3be519be17ecb46408d22315999c420fb6d29472452fec189ecafadbf5049c2874a5bb3b0844

        • memory/2420-66-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2420-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2420-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2420-20-0x00000000024A0000-0x00000000024D1000-memory.dmp

          Filesize

          196KB

        • memory/2420-19-0x00000000024A0000-0x00000000024D1000-memory.dmp

          Filesize

          196KB

        • memory/2420-79-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2420-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2420-80-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2420-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2420-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2628-73-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2628-67-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2632-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2632-61-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2632-56-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2632-84-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2736-36-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2736-41-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2736-37-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2736-54-0x0000000002660000-0x0000000002691000-memory.dmp

          Filesize

          196KB

        • memory/2736-77-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2736-53-0x0000000002660000-0x0000000002691000-memory.dmp

          Filesize

          196KB

        • memory/2884-30-0x0000000002480000-0x00000000024B1000-memory.dmp

          Filesize

          196KB

        • memory/2884-17-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2884-21-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2884-82-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2884-93-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB