sality | 0e1c4959ad7549094383552f76aa2eeae497c216ed5a233c7f901b3891287971

Analysis

max time kernel
43s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Size 736KB
Sample240617-aar54ayeqp
SHA256 0e1c4959ad7549094383552f76aa2eeae497c216ed5a233c7f901b3891287971
MD5 215be702816a66d7b4a8884c71dd8100
SHA1 9f5efe443c242ef5e81f1ceca81b9c02353fa87e
SHA512 84a956cab8b81e3cd317a28569b59d937b5464762af3df6841a2bbc959a97888e70a8d381cad1f15eeb32487b33d9f4723432c295181294329787a374345293f
SSDEEP 12288:nTyjXW+48qWywrU4kGFezOAVuJ5PIjww7F5DO3HYffrvlbTzZ:TIXW/8yw1ez54lIfF5SXYHTlbTzZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll32.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rundll32.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	rundll32.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1012-1-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-3-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-5-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-6-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-7-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-4-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-8-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-14-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-15-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-20-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-24-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-27-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-35-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/1012-28-0x00000000032C0000-0x000000000437A000-memory.dmp	upx
behavioral2/memory/2156-54-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-52-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-55-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-62-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-71-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-60-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-58-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-56-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-61-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-59-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-57-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-73-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-74-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-75-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-76-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-77-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-80-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-81-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-83-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-84-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-86-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-88-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-91-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-129-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx
behavioral2/memory/2156-160-0x0000000004EE0000-0x0000000005F9A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\A:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	rundll32.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\e57ab34	rundll32.exe
File created	C:\Windows\e576206	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
File opened for modification	C:\Windows\SYSTEM.INI	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Token: SeDebugPrivilege	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
2156	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 788	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	8
PID 1012 wrote to memory of 784	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	9
PID 1012 wrote to memory of 380	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	13
PID 1012 wrote to memory of 2920	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	49
PID 1012 wrote to memory of 2960	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	51
PID 1012 wrote to memory of 2076	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	52
PID 1012 wrote to memory of 3432	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	56
PID 1012 wrote to memory of 3576	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	57
PID 1012 wrote to memory of 3772	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	58
PID 1012 wrote to memory of 3868	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	59
PID 1012 wrote to memory of 3940	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	60
PID 1012 wrote to memory of 4052	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	61
PID 1012 wrote to memory of 3736	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	62
PID 1012 wrote to memory of 1672	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	64
PID 1012 wrote to memory of 2644	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	75
PID 1012 wrote to memory of 1140	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	79
PID 1012 wrote to memory of 4420	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	80
PID 1012 wrote to memory of 2156	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	83
PID 1012 wrote to memory of 2156	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	83
PID 1012 wrote to memory of 2156	1012	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe	83
PID 2156 wrote to memory of 788	2156	rundll32.exe	8
PID 2156 wrote to memory of 784	2156	rundll32.exe	9
PID 2156 wrote to memory of 380	2156	rundll32.exe	13
PID 2156 wrote to memory of 2920	2156	rundll32.exe	49
PID 2156 wrote to memory of 2960	2156	rundll32.exe	51
PID 2156 wrote to memory of 2076	2156	rundll32.exe	52
PID 2156 wrote to memory of 3432	2156	rundll32.exe	56
PID 2156 wrote to memory of 3576	2156	rundll32.exe	57
PID 2156 wrote to memory of 3772	2156	rundll32.exe	58
PID 2156 wrote to memory of 3868	2156	rundll32.exe	59
PID 2156 wrote to memory of 3940	2156	rundll32.exe	60
PID 2156 wrote to memory of 4052	2156	rundll32.exe	61
PID 2156 wrote to memory of 3736	2156	rundll32.exe	62
PID 2156 wrote to memory of 1672	2156	rundll32.exe	64
PID 2156 wrote to memory of 2644	2156	rundll32.exe	75
PID 2156 wrote to memory of 1140	2156	rundll32.exe	79
PID 2156 wrote to memory of 4420	2156	rundll32.exe	80
PID 2156 wrote to memory of 4476	2156	rundll32.exe	84
PID 2156 wrote to memory of 4036	2156	rundll32.exe	85
PID 2156 wrote to memory of 788	2156	rundll32.exe	8
PID 2156 wrote to memory of 784	2156	rundll32.exe	9
PID 2156 wrote to memory of 380	2156	rundll32.exe	13
PID 2156 wrote to memory of 2920	2156	rundll32.exe	49
PID 2156 wrote to memory of 2960	2156	rundll32.exe	51
PID 2156 wrote to memory of 2076	2156	rundll32.exe	52
PID 2156 wrote to memory of 3432	2156	rundll32.exe	56
PID 2156 wrote to memory of 3576	2156	rundll32.exe	57
PID 2156 wrote to memory of 3772	2156	rundll32.exe	58
PID 2156 wrote to memory of 3868	2156	rundll32.exe	59
PID 2156 wrote to memory of 3940	2156	rundll32.exe	60
PID 2156 wrote to memory of 4052	2156	rundll32.exe	61
PID 2156 wrote to memory of 3736	2156	rundll32.exe	62
PID 2156 wrote to memory of 1672	2156	rundll32.exe	64
PID 2156 wrote to memory of 2644	2156	rundll32.exe	75
PID 2156 wrote to memory of 1140	2156	rundll32.exe	79
PID 2156 wrote to memory of 4420	2156	rundll32.exe	80
PID 2156 wrote to memory of 4476	2156	rundll32.exe	84
PID 2156 wrote to memory of 4036	2156	rundll32.exe	85
PID 2156 wrote to memory of 788	2156	rundll32.exe	8
PID 2156 wrote to memory of 784	2156	rundll32.exe	9
PID 2156 wrote to memory of 380	2156	rundll32.exe	13
PID 2156 wrote to memory of 2920	2156	rundll32.exe	49
PID 2156 wrote to memory of 2960	2156	rundll32.exe	51
PID 2156 wrote to memory of 2076	2156	rundll32.exe	52

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:380

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2960

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\215be702816a66d7b4a8884c71dd8100_NeikiAnalytics.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
    3⤵
    - Modifies firewall policy service
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3576

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3772

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3940

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1672

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2644

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1140

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4420

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4476

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rundll32.exe

Path C:\Users\Admin\AppData\Local\Temp\0E578B87_Rar\rundll32.exe
Size 664KB
SHA256 e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
MD5 2eb5d76180ce7b3241b281fa79ab3483
SHA1 06293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA512 35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
SSDEEP 12288:DTyjXW+48qWywrU4kGFezOAVuJ5PIGww7F5DO3HYffS:fIXW/8yw1ez54lIYF5SXYHS
MD5 SHA1 SHA512 SSDEEP

Submit Download

rundll32.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
Size 736KB
SHA256 0e1c4959ad7549094383552f76aa2eeae497c216ed5a233c7f901b3891287971
MD5 215be702816a66d7b4a8884c71dd8100
SHA1 9f5efe443c242ef5e81f1ceca81b9c02353fa87e
SHA512 84a956cab8b81e3cd317a28569b59d937b5464762af3df6841a2bbc959a97888e70a8d381cad1f15eeb32487b33d9f4723432c295181294329787a374345293f
SSDEEP 12288:nTyjXW+48qWywrU4kGFezOAVuJ5PIjww7F5DO3HYffrvlbTzZ:TIXW/8yw1ez54lIfF5SXYHTlbTzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYSTEM.INI

Path C:\Windows\SYSTEM.INI
Size 257B
SHA256 c49c5b5b48c0254ba0cc86e472e92918cb230a7693122e26a018d99fd26cb667
MD5 ea394ce80efd9ea3ae97c46e133bcc76
SHA1 8e2900f3e2a65aba56e8c910bbb2d74e0c122de7
SHA512 87be20cd63b602e7ba221ac304ffddd3299bf24a10db914bba236423ee7f641ad59456f75d912dff313a73fc44e0ca11d9c6feee8e133c6173d89b71f05ddc2a
MD5 SHA1 SHA512

Submit Download

iagju.exe

Path C:\iagju.exe
Size 97KB
SHA256 7c9ea91c2b44960e621be438e7d076c5c9a9ba986306579b15b27dc2b5454c5c
MD5 222faa9b1bb93f0163a93f8660b9026d
SHA1 ad42684c0678f99b3253d5e3b2e90cfe45f1cde8
SHA512 cd779f1c13045eb033acdb9f053032982f914ad79fe17b4521b61a24344cb323e2ca0a091d145e5a5b383b3cc176a20d1bcdc963c0f01fd61346bf5fe32bc041
SSDEEP 1536:fgQiaO8hW9WwRJBrWUGsOgbun+FL44aVePzO00rsoBXHTPLu5Y1cmfDUEi:oNaBW9Wka2Ogbus4PwO00woZTzeWDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1012-0-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1012-1-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-3-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-5-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-6-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-7-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-4-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-8-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-14-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-15-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-23-0x00000000009B0000-0x00000000009B2000-memory.dmp

Download

memory/1012-22-0x00000000009B0000-0x00000000009B2000-memory.dmp

Download

memory/1012-17-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/1012-16-0x00000000009B0000-0x00000000009B2000-memory.dmp

Download

memory/1012-20-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-24-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-27-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-35-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/1012-48-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1012-36-0x00000000009B0000-0x00000000009B2000-memory.dmp

Download

memory/1012-28-0x00000000032C0000-0x000000000437A000-memory.dmp

Download

memory/2156-55-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-73-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-52-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-33-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2156-72-0x00000000030D0000-0x00000000030D2000-memory.dmp

Download

memory/2156-62-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-71-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-70-0x00000000030D0000-0x00000000030D2000-memory.dmp

Download

memory/2156-60-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-58-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-56-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-64-0x00000000037B0000-0x00000000037B1000-memory.dmp

Download

memory/2156-61-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-59-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-57-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-54-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-74-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-75-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-76-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-77-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-80-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-81-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-83-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-84-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-86-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-88-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-91-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-129-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download

memory/2156-130-0x00000000030D0000-0x00000000030D2000-memory.dmp

Download

memory/2156-159-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2156-160-0x0000000004EE0000-0x0000000005F9A000-memory.dmp

Download