Analysis

  • max time kernel
    123s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 05:17

General

  • Target

    a50d012aac0b6d6abf4bb39c38070610_NeikiAnalytics.exe

  • Size

    1.8MB

  • MD5

    a50d012aac0b6d6abf4bb39c38070610

  • SHA1

    ca381c517ac20e38a217f74d0633786b258218b0

  • SHA256

    9e942da3cd2a1870a5f5d0a6f9d6d9cc22e07bc709fce94f0474bb1c854a9d6d

  • SHA512

    f3f33b49dcdc20cf8e7126d5c1b9ddb3590c9fb462b0e8e42a59c3da5f66018d57205f66c2a58f88bd771dfd2debc1f6ae2ddacee4e6a7f4f88408ef9991710e

  • SSDEEP

    24576:bGLXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0a:bGxbTChxKCnFnQXBbrtgb/iQvu0UHOm

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a50d012aac0b6d6abf4bb39c38070610_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a50d012aac0b6d6abf4bb39c38070610_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Users\Admin\AppData\Local\Temp\@AE7916.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\@AE7916.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1436
          • C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1816
              • C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 2880
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:684
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "
                  8⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1752
                  • C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                    "C:\Users\Admin\AppData\Local\Temp\wtmps.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:2888
                    • C:\Windows\SysWOW64\mscaps.exe
                      "C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe
                      10⤵
                      • Executes dropped EXE
                      PID:1740
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "
          4⤵
            PID:1464
        • C:\Users\Admin\AppData\Local\Temp\a50d012aac0b6d6abf4bb39c38070610_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\a50d012aac0b6d6abf4bb39c38070610_NeikiAnalytics.exe"
          3⤵
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Modifies registry class
          PID:2412

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\9260.tmp

      Filesize

      406B

      MD5

      37512bcc96b2c0c0cf0ad1ed8cfae5cd

      SHA1

      edf7f17ce28e1c4c82207cab8ca77f2056ea545c

      SHA256

      27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f

      SHA512

      6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641

    • C:\Users\Admin\AppData\Local\Temp\Se7E46.tmp

      Filesize

      896B

      MD5

      be49ee9d1b6da594241ce3b7432c5d64

      SHA1

      d81e68b9bf84258af2e6b5595c4f5c8d53b9c901

      SHA256

      db66d62796ae12bf459e514f27bb1a0d416d804365f44e8ec53dd760e3f7b8b8

      SHA512

      0c15d8d86e0dfccbcecd50b3dd5906f8f5b7c52511128d01be82b394ccb08ed85a486a101bbb5d992a688d1e62f21fda712daef1bf3a5ecba9aad152e47562f5

    • C:\Users\Admin\AppData\Local\Temp\a50d012aac0b6d6abf4bb39c38070610_NeikiAnalytics.exe

      Filesize

      98KB

      MD5

      d262bba0662a92251adc01de82d15ebb

      SHA1

      b19f26ad0523d4a2a87255e0b1cfb077693b50b5

      SHA256

      c5a2eae223748d9261fa273be0dd4a79e8ff5a9a65ae46d3161725472067b6ff

      SHA512

      b3980fb641be55a248da0871b33791e4bda2976efd5ef2cc98822ac950646e92497c484a0a20949966e2490829faa0b75c9304d73ed93bc93b2061bef9a979ce

    • C:\Users\Admin\AppData\Local\Temp\tmp82B9.tmp

      Filesize

      120KB

      MD5

      f558c76b0376af9273717fa24d99ebbf

      SHA1

      f84bcece5c6138b62ef94e9d668cf26178ee14cc

      SHA256

      01631353726dc51bcea311dbc012572cf96775e516b1c79a2de572ef15954b7a

      SHA512

      2092d1e126d0420fec5fc0311d6b99762506563f4890e4049e48e2d87dde5ac3e2e2ecc986ab305de2c6ceb619f18879a69a815d3241ccf8140bc5ea00c6768d

    • C:\Users\Admin\AppData\Local\Temp\wtmps.exe

      Filesize

      276KB

      MD5

      75c1467042b38332d1ea0298f29fb592

      SHA1

      f92ea770c2ddb04cf0d20914578e4c482328f0f8

      SHA256

      3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373

      SHA512

      5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0

    • C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat

      Filesize

      129B

      MD5

      d1073c9b34d1bbd570928734aacff6a5

      SHA1

      78714e24e88d50e0da8da9d303bec65b2ee6d903

      SHA256

      b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020

      SHA512

      4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f

    • C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

      Filesize

      126B

      MD5

      aa4139784f4032414191f2c5c7c8b7e7

      SHA1

      5b4d66a0c8aa1f93eb5aa4d739ea4fa346f83765

      SHA256

      50ad75635eded642510d731fd1f7e60ccfa776fb24f8fd741eef920f59693a31

      SHA512

      ff02d4bf683ab14df996f38bfb00e17debe9ce829fd38c60c961ebc00272e2be88c971bfc0977d98cf451a23395819037904789d66c7523d9e57f0a555d608d4

    • C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

      Filesize

      196B

      MD5

      f11e6ac7ac8a67a38adcbac3712f4d92

      SHA1

      ae44150c7ccd79ec23466b61a01f32163612e94f

      SHA256

      a2e3658b782cad25387888c3150d4d367caa53dc0484199d6ddd4357ab52dc9b

      SHA512

      bccf1b83ca6855f4fb783fe0d776a440724e3767e389317b003b2ebbc1d163206a598fb45b4f1a8a6f5f6d95706871af6b75fe55314637ace3918cc6506836e9

    • C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat

      Filesize

      102B

      MD5

      3ca08f080a7a28416774d80552d4aa08

      SHA1

      0b5f0ba641204b27adac4140fd45dce4390dbf24

      SHA256

      4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0

      SHA512

      0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01

    • C:\Windows\SysWOW64\mscaps.exe

      Filesize

      200KB

      MD5

      78d3c8705f8baf7d34e6a6737d1cfa18

      SHA1

      9f09e248a29311dbeefae9d85937b13da042a010

      SHA256

      2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905

      SHA512

      9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609

    • \Users\Admin\AppData\Local\Temp\@AE7916.tmp.exe

      Filesize

      1.7MB

      MD5

      fde49dd7a1774804d072059910528a8b

      SHA1

      1003c6ea0b7cafaef6b269db4f10a3288f780516

      SHA256

      e5c44214fc2e81606b6894484de59c3283a6c58ca8d2f87c0fa8d373930895eb

      SHA512

      140093719fdd15d75c7d3fe9714e3a7f98a0c210160e95082c93fe3c4a2e209b60e44ceeef096f308b4ba2c070d34a0150f72da5cf01d779af13eb003690b0a7

    • \Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe

      Filesize

      172KB

      MD5

      daac1781c9d22f5743ade0cb41feaebf

      SHA1

      e2549eeeea42a6892b89d354498fcaa8ffd9cac4

      SHA256

      6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c

      SHA512

      190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160

    • \Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

      Filesize

      1.7MB

      MD5

      e95760480a8710a64999a7cf2b391664

      SHA1

      0cc178cb2a1d630ebb1f47ecd12282dc3ca038ae

      SHA256

      ca1a6557e84f4882b9e8409d134606b8d1a5651db265c0c746a3fe3730c8e92e

      SHA512

      02fa873ad965c81eddd1d6372948d4de9719d6bb3256a03e70adf7ff4f58dab28ec4ea8c69c18bfed0653c61fd80ad9307ae770800e8452cfe8a25b4d895bd85

    • \Users\Admin\AppData\Roaming\Temp\mydll.dll

      Filesize

      202KB

      MD5

      7ff15a4f092cd4a96055ba69f903e3e9

      SHA1

      a3d338a38c2b92f95129814973f59446668402a8

      SHA256

      1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627

      SHA512

      4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

    • memory/684-281-0x0000000010000000-0x0000000010015000-memory.dmp

      Filesize

      84KB

    • memory/1652-9-0x0000000010000000-0x0000000010015000-memory.dmp

      Filesize

      84KB