25c4ef606891510b36fe99d74aa56033bdcff40a9316d4f02b518bdeb7a03d16

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
Size

66KB
MD5

3737f5ec040b2beb023256e23f621c30
SHA1

3a2dcc1f0755172f916e4f97e2bd83a26de81df7
SHA256

25c4ef606891510b36fe99d74aa56033bdcff40a9316d4f02b518bdeb7a03d16
SHA512

6977bb44b370829d4dd873df18451bcb28214f0a48297ec41159be6ecbd505156e2999c6e4e7e4f16e332efbb778d49040663c1b7a19957709257890b3668e87
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXif:IeklMMYJhqezw/pXzH9if

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2716	explorer.exe
2736	spoolsv.exe
2504	svchost.exe
2480	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
2716	explorer.exe
2716	explorer.exe
2736	spoolsv.exe
2736	spoolsv.exe
2504	svchost.exe
2504	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
2716	explorer.exe
2716	explorer.exe
2716	explorer.exe
2504	svchost.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe
2716	explorer.exe
2504	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2716	explorer.exe
2504	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
2716	explorer.exe
2716	explorer.exe
2736	spoolsv.exe
2736	spoolsv.exe
2504	svchost.exe
2504	svchost.exe
2480	spoolsv.exe
2480	spoolsv.exe
2716	explorer.exe
2716	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2716	2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe	28
PID 2908 wrote to memory of 2716	2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe	28
PID 2908 wrote to memory of 2716	2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe	28
PID 2908 wrote to memory of 2716	2908	3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe	28
PID 2716 wrote to memory of 2736	2716	explorer.exe	29
PID 2716 wrote to memory of 2736	2716	explorer.exe	29
PID 2716 wrote to memory of 2736	2716	explorer.exe	29
PID 2716 wrote to memory of 2736	2716	explorer.exe	29
PID 2736 wrote to memory of 2504	2736	spoolsv.exe	30
PID 2736 wrote to memory of 2504	2736	spoolsv.exe	30
PID 2736 wrote to memory of 2504	2736	spoolsv.exe	30
PID 2736 wrote to memory of 2504	2736	spoolsv.exe	30
PID 2504 wrote to memory of 2480	2504	svchost.exe	31
PID 2504 wrote to memory of 2480	2504	svchost.exe	31
PID 2504 wrote to memory of 2480	2504	svchost.exe	31
PID 2504 wrote to memory of 2480	2504	svchost.exe	31
PID 2504 wrote to memory of 2004	2504	svchost.exe	32
PID 2504 wrote to memory of 2004	2504	svchost.exe	32
PID 2504 wrote to memory of 2004	2504	svchost.exe	32
PID 2504 wrote to memory of 2004	2504	svchost.exe	32
PID 2504 wrote to memory of 1280	2504	svchost.exe	36
PID 2504 wrote to memory of 1280	2504	svchost.exe	36
PID 2504 wrote to memory of 1280	2504	svchost.exe	36
PID 2504 wrote to memory of 1280	2504	svchost.exe	36
PID 2504 wrote to memory of 2364	2504	svchost.exe	38
PID 2504 wrote to memory of 2364	2504	svchost.exe	38
PID 2504 wrote to memory of 2364	2504	svchost.exe	38
PID 2504 wrote to memory of 2364	2504	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3737f5ec040b2beb023256e23f621c30_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2004
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1280
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
ce101febe6b2d9128be309732fecf22d

SHA1
604d24b9b485ab9b9cf944fb61c95601e3c4cb41

SHA256
e73fe62908734281b1fce1e8b18e09a17b66a2e565e30286428ad52115caa736

SHA512
4258a8de179605d77fd132df21ef681c0f2b1bc9237d2f58061bc2b4e59eb2d26404242d256f2e1d4a21642007623e5628fc85bd9e6877372e70660111b495c3

Download Submit
C:\Windows\system\explorer.exe

Filesize
66KB

MD5
ab5c6ae4885e1d3ad3d912bb9d05d74a

SHA1
249caef41f690befa72d8b21146fa8ae701050c6

SHA256
2ef77f03004dbc1713b7d0deffad75effef89f75d3809c0b1c24588af6100c9d

SHA512
b52acfaee8b4ae539a3eee5501a06a506d1a1a227c51d33d7d786c91460197cbf4c733c490256c94a5eb928c31f73ffb14c0e63a0b1281c40dd0670e9a5909f0

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
eedcf51e104aced305581302a7603ad8

SHA1
fe2d373a86be4eb46b3b07a22c43f8fa684e3640

SHA256
24ac412f24fa8dd08db65b20dde08b8a4b600f4f18cc4df3e68a5a7ea0f3ea8b

SHA512
c5ff1536d9e9a95a8ca756538922d51bf17febd8408ca4703902d3414354f2e86e3808b0ac20badaca3a6035faa1ef12c04760b7e1975775274905cb16426d96

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
ee74de1b23814ddf7be502eb5c407b90

SHA1
51ddc37cae39cce01db77bb26334e9ba150bda56

SHA256
9f79eccc6cdc669378b254c9d3a1081e83abec5e08cd1ffcb3a3646777770907

SHA512
ae280cb130230be3f739058e22fb378a0615989b974fa4524f20c69a621fd5cbd84cccc39c016bb31498522ca3fc558dd2ee4f248eb48877eefd13e123e2081b

Download Submit
memory/2480-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2480-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2504-56-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2504-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2504-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2504-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-34-0x0000000003260000-0x0000000003291000-memory.dmp

Filesize
196KB

Download
memory/2716-35-0x0000000003260000-0x0000000003291000-memory.dmp

Filesize
196KB

Download
memory/2716-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-17-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2716-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2736-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2736-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2736-46-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2736-54-0x00000000007B0000-0x00000000007E1000-memory.dmp

Filesize
196KB

Download
memory/2736-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2908-19-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2908-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2908-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2908-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2908-20-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2908-6-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2908-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2908-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2908-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download