Analysis

  • max time kernel
    150s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 05:18

General

  • Target

    a511a473c7cd7d3ca87ebf8636fa3a70_NeikiAnalytics.exe

  • Size

    207KB

  • MD5

    a511a473c7cd7d3ca87ebf8636fa3a70

  • SHA1

    872bd67f81a1ab3c962157f893b6d0aed9917d4a

  • SHA256

    2fd3a3575350e2281852d333c0da4a09043f2de39efb9e72941ef00d1a96fc24

  • SHA512

    3009286042351a132a153bb34212d33dc33d52e70a2549ada59a9fe287900593704c20edaae075326ecf9e83d0ca8dc766f89867f6ae54eb9d28b81f3a5fb1c7

  • SSDEEP

    3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL0:5vEN2U+T6i5LirrllHy4HUcMQY6K0

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a511a473c7cd7d3ca87ebf8636fa3a70_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a511a473c7cd7d3ca87ebf8636fa3a70_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1344
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1148
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1436
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3344
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2120
          • C:\Windows\SysWOW64\at.exe
            at 05:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:4200
            • C:\Windows\SysWOW64\at.exe
              at 05:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3168
              • C:\Windows\SysWOW64\at.exe
                at 05:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4832

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          206KB

          MD5

          02d163b39c2d1611f5332ed7296842e0

          SHA1

          fc446d98a0c5d33392daa70374b27580f94a45e5

          SHA256

          814975598dace5ade738abde8fc43686e6543caf915891e76c7d29a332fa269c

          SHA512

          fef8e7775d4a22a97dad59ed3299eb734684e53859d2bfeab94d48b1efd2b6e3b420c2dd52cb0f35282770d22b1816f7822c681a818b50641c104e19bc38cbff

        • C:\Windows\System\explorer.exe

          Filesize

          206KB

          MD5

          bdd47b84122bc94f69276ee8f9ec5b98

          SHA1

          d6d9fc66a6d116efa2e5c844ef0fc4cd0ee6baae

          SHA256

          0a29e648ef70aa4729ef1806f0e902487c795b9bc95d54816e7185c3c5b3328f

          SHA512

          177cb8927d0ef8df9faebb7f1e1c374a85ab49077ee61be20ea45845f2df41c6ead60473b60a279526e1b05eca93a96d0ed7c1ef0bffd2eb0c41a1f5f8ed6818

        • C:\Windows\System\spoolsv.exe

          Filesize

          206KB

          MD5

          daf75b2e40838e14369c981ad5cbb85a

          SHA1

          753665b2747709b5ce5620587d942bde6977336b

          SHA256

          543c465f0460802341aa433787264a0a1bf1a18deb2a35dbf7c912b9752b722f

          SHA512

          5b96e5b841e63ec2ac6b317e5741f48e0544a4a5529e96f3d5a0f9a109ce8138b868622df64b6dce329f6bc7b3663cf10c125e7a12de668a523d33867fd09cbb

        • C:\Windows\System\svchost.exe

          Filesize

          206KB

          MD5

          b27a152be0194a6fa6af8abf6dd411d0

          SHA1

          f320c597921045d9d6863e511c1ac22b70968202

          SHA256

          0686f685ca8abcefe742f6264369c1e483b4ca7af08537038e351911bde446a3

          SHA512

          00d0e2d166d18982de74c18b19fb1a7dea6745e76ccbd03b91e3757dd77174e73ec170ca7469a4b1a54f7879243ef0e31f99bb633914a439948d79ff11d27048

        • memory/1344-0-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/1344-37-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/1436-36-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2120-33-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/3344-25-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB