ce523103cb5e5b37fb2a55228dddc43c5654057a0a9ea7f142c8ab9fd85539cb

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe
Size

349KB
MD5

4043ca7b69b272b4659c032a45488510
SHA1

b77e2de5d36a5548430ba9c5c5e08a7671afdb36
SHA256

ce523103cb5e5b37fb2a55228dddc43c5654057a0a9ea7f142c8ab9fd85539cb
SHA512

df704d86f0664ee0ccf9d5205f073bec8c40bf54311b0db67640f7f905f5c98dcc1e62cdb79150f1861a8b1b86774f9367ab9f2d28fdcdecaa0a508eb1458b5c
SSDEEP

6144:eVTQqSiexKAK4y6UvcZSeNH49qQQOH+ym4LLIoTqHSMaxzL:ASiOK4yjNQOGzoTCSMG

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
228	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\22c3a3fe = "C:\\Windows\\apppatch\\svchost.exe"	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\22c3a3fe = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4204	228	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
228	svchost.exe
228	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1892	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 228	1892	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe	82
PID 1892 wrote to memory of 228	1892	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe	82
PID 1892 wrote to memory of 228	1892	4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4043ca7b69b272b4659c032a45488510_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 804
    3⤵
    - Program crash
    PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
349KB

MD5
e9706cf4a0936459e03b7fda30b1b014

SHA1
5882f52dd8e7fa8684de35e6b801886bdfaa2f15

SHA256
cf1f936b22987b3b6d94292de4ef7ad4ab2c6c79a5084c3009f6be420c6ab11d

SHA512
8bd02ae5de0a93178cfbdd540fc1fc5f58709b8798116a6f8daa49ddcc30f11ee17b9f693edab7245f4ad975232cb5878f6dd0d1cb603f3d78320d99478b4d5c

Download Submit
memory/228-10-0x0000000002C00000-0x0000000002C4A000-memory.dmp

Filesize
296KB

Download
memory/228-13-0x0000000002D90000-0x0000000002DE8000-memory.dmp

Filesize
352KB

Download
memory/228-14-0x0000000002D90000-0x0000000002DE8000-memory.dmp

Filesize
352KB

Download
memory/228-16-0x0000000002D90000-0x0000000002DE8000-memory.dmp

Filesize
352KB

Download
memory/228-19-0x0000000002D90000-0x0000000002DE8000-memory.dmp

Filesize
352KB

Download
memory/1892-9-0x0000000000B30000-0x0000000000B99000-memory.dmp

Filesize
420KB

Download