Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 06:24
Behavioral task
behavioral1
Sample
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe
-
Size
130KB
-
MD5
5982d06eb012c2810a16d7ef5d00c250
-
SHA1
b4171066d17053b516606506a203997820762188
-
SHA256
1d2a9343e49feb4d836189fa220f74a33f98db8a7e1aa59fc67a218ef645d38e
-
SHA512
5e7e350c0bc21ea97a00fae40bbe900486f94fd85aabf66659410bd727856f838682e669ae816f0205a42234a2bddca061739b7d57534eae7819d33a885b7c88
-
SSDEEP
1536:eH1ZaQvR1KiX3NK6I+hZhYrt/w5Q6G6IpiRYzz9qJHhhnm0yG5aP/5UROXTmZ:SKQJcinxphkG5Q6GdpIOkJHhKRyOXK
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/5012-49-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5012-51-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5012-52-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5012-55-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 behavioral2/memory/5012-46-0x0000000000400000-0x0000000000411000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Flaseher.exeFlaseher.exeFlaseher.exepid process 4996 Flaseher.exe 4056 Flaseher.exe 5012 Flaseher.exe -
Processes:
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4596-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4936-13-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4596-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4596-14-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe upx behavioral2/memory/4996-37-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4996-41-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4996-42-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4996-43-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4996-53-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4596-58-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4056-60-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exeFlaseher.exedescription pid process target process PID 4936 set thread context of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4996 set thread context of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 set thread context of 5012 4996 Flaseher.exe Flaseher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Flaseher.exedescription pid process Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe Token: SeDebugPrivilege 4056 Flaseher.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exeFlaseher.exeFlaseher.exepid process 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 4996 Flaseher.exe 4056 Flaseher.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.execmd.exeFlaseher.exedescription pid process target process PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4936 wrote to memory of 4596 4936 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe PID 4596 wrote to memory of 3456 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe cmd.exe PID 4596 wrote to memory of 3456 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe cmd.exe PID 4596 wrote to memory of 3456 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe cmd.exe PID 3456 wrote to memory of 1940 3456 cmd.exe reg.exe PID 3456 wrote to memory of 1940 3456 cmd.exe reg.exe PID 3456 wrote to memory of 1940 3456 cmd.exe reg.exe PID 4596 wrote to memory of 4996 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe Flaseher.exe PID 4596 wrote to memory of 4996 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe Flaseher.exe PID 4596 wrote to memory of 4996 4596 5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 4056 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe PID 4996 wrote to memory of 5012 4996 Flaseher.exe Flaseher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5982d06eb012c2810a16d7ef5d00c250_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UIJFD.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\UIJFD.txtFilesize
145B
MD5da0cbe87b720a79b294147ed6a4b98be
SHA1ebf0dc9efd7a12cb192e355cda87546acb4ab360
SHA2567ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed
SHA512f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exeFilesize
130KB
MD5bc756127c379e5155b2ac8e6703da904
SHA13be4f8c33969ee6ce3673e00b8238757f7868c8f
SHA256634c02436107bc5aa6f1b342db23f70b2f304722c764427d9f810c2f351fea94
SHA512bbbd23ac07a034507dc964b037e81e118e96d15fbceeb66c4774e0f7082d77fc015440724c6f20e85976c61af3427b7bd44d0435f4f51382ad28001d33ce8855
-
memory/4056-60-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4596-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4596-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4596-14-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4596-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4936-7-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4936-13-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4936-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4936-8-0x0000000002B70000-0x0000000002B71000-memory.dmpFilesize
4KB
-
memory/4936-6-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4936-3-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/4936-5-0x0000000002AE0000-0x0000000002AE1000-memory.dmpFilesize
4KB
-
memory/4936-4-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/4996-43-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4996-42-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4996-53-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4996-41-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4996-37-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/5012-49-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/5012-51-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/5012-52-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/5012-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/5012-46-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB