Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 05:03

General

  • Target

    a45c75ee4ccf86cda5643524d14568b0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    a45c75ee4ccf86cda5643524d14568b0

  • SHA1

    c6d47b9d3fb6bb6fb9e2f93e5557aea6ec97e31a

  • SHA256

    6aef9ea370a7a355f11c5801112f7671918619837c6a42c91f62f7fea214d4e9

  • SHA512

    2a76877c034fcdaec22d4ce0592b9c200ebd0fc0b2feee1a67dba4183f98d094358a30107ac0cbf9b30b3ed07dfcd353be91dc7028fd602b215e879d90dcdb9c

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi7:IeklMMYJhqezw/pXzH9i7

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a45c75ee4ccf86cda5643524d14568b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a45c75ee4ccf86cda5643524d14568b0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4404
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3700
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1700
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4624
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4700
          • C:\Windows\SysWOW64\at.exe
            at 05:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:3232
            • C:\Windows\SysWOW64\at.exe
              at 05:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1964
              • C:\Windows\SysWOW64\at.exe
                at 05:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4916

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          7a77bd6b421cb7472f3e298277baf264

          SHA1

          4d93c4913b08ae1ddbdf2174a61b0ae26e8b1283

          SHA256

          d3ca8eed74480bd9ea5814ad0dab5b54e3dde1f5945f3342d8c5291da04667cd

          SHA512

          b02139f1d62ef2627ce987fecdf6b9a693b7c779cca9467c2130e40c2831e955375ec668e25af15413d6decc55f556b3525971889c4d1be18fd1b5f3696e12d5

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          a470d73f0d2481598c7cb0b7763fa951

          SHA1

          1a8c7c773e33098dfa1b326eabfa14b8e5fb769c

          SHA256

          c61ace3660d8813d8a510c158c9df61599b27c5c08400a1242b8ffd7ba49b8b2

          SHA512

          7ba6fccc4ddb58ec43ceeca129cabc22455630f13151f6b705cd30af906e662d9b59682a6144eb488d6186f53cab135f7d7a0082274ce9d95b3b798683a0c693

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          b5fe915489967d311e758d018d501784

          SHA1

          f92f45f0c158aac11a8eb53b8eca9d5e4f45e99b

          SHA256

          e315fba3ecc0feeee2b32ecdd3ff872e79d0cc740ed9a4b4f2f895e82f759ea9

          SHA512

          3c67629182fb166fc9e25e7122121fd64e80e3efed248e1a954ec1393a6cf7de23bc2b08061cf84736e477d61e5fe615bc7911b4704ea623b67552ef5c3d06ac

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          ab6c11793fc57d260f15f28353dae216

          SHA1

          f4818cb1e9cd0561a54320fbb4d86ec8ec298ebf

          SHA256

          93a5aaab9a9e6ad37fecface1d87d23c7e3836f83b6954c6ff60024f14299c6b

          SHA512

          a48c8b99f8069ceb03e44e385dbf5826373e5c78dfc2c9c6291f3be519be17ecb46408d22315999c420fb6d29472452fec189ecafadbf5049c2874a5bb3b0844

        • memory/1700-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1700-27-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

          Filesize

          1.4MB

        • memory/1700-25-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1700-26-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3700-13-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3700-14-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

          Filesize

          1.4MB

        • memory/3700-16-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3700-71-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3700-60-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4404-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4404-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/4404-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4404-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4404-44-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4404-2-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

          Filesize

          1.4MB

        • memory/4404-58-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/4404-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4624-37-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

          Filesize

          1.4MB

        • memory/4624-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4624-42-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4700-53-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/4700-45-0x0000000074EA0000-0x0000000074FFD000-memory.dmp

          Filesize

          1.4MB