34233911c8a1a874ee4009b7bd6b36a558aca7dcb12f443cbe8877f7968b968c

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
Size

66KB
MD5

5dbca57b201b24cf86387e90b35b28a0
SHA1

467f93a895a8c2242c52d3ee279935aec8af69c8
SHA256

34233911c8a1a874ee4009b7bd6b36a558aca7dcb12f443cbe8877f7968b968c
SHA512

b33a59e39890b98b5d91329044ebd3fd233c3ae4a4d7ccc2f9cef38f82f8eedf701dd9c957908b33fe89cbb46d74c160ca744e4cc1931a9a8976d48ed54a399d
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi/VVVVVVVVVVVVVVVVVVVVQ:IeklMMYJhqezw/pXzH9i/VVVVVVVVVVs

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2312	explorer.exe
2484	spoolsv.exe
2520	svchost.exe
2368	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
2312	explorer.exe
2312	explorer.exe
2484	spoolsv.exe
2484	spoolsv.exe
2520	svchost.exe
2520	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
2312	explorer.exe
2312	explorer.exe
2312	explorer.exe
2520	svchost.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe
2312	explorer.exe
2520	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2312	explorer.exe
2520	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
2312	explorer.exe
2312	explorer.exe
2484	spoolsv.exe
2484	spoolsv.exe
2520	svchost.exe
2520	svchost.exe
2368	spoolsv.exe
2368	spoolsv.exe
2312	explorer.exe
2312	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2312	2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe	28
PID 2556 wrote to memory of 2312	2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe	28
PID 2556 wrote to memory of 2312	2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe	28
PID 2556 wrote to memory of 2312	2556	5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe	28
PID 2312 wrote to memory of 2484	2312	explorer.exe	29
PID 2312 wrote to memory of 2484	2312	explorer.exe	29
PID 2312 wrote to memory of 2484	2312	explorer.exe	29
PID 2312 wrote to memory of 2484	2312	explorer.exe	29
PID 2484 wrote to memory of 2520	2484	spoolsv.exe	30
PID 2484 wrote to memory of 2520	2484	spoolsv.exe	30
PID 2484 wrote to memory of 2520	2484	spoolsv.exe	30
PID 2484 wrote to memory of 2520	2484	spoolsv.exe	30
PID 2520 wrote to memory of 2368	2520	svchost.exe	31
PID 2520 wrote to memory of 2368	2520	svchost.exe	31
PID 2520 wrote to memory of 2368	2520	svchost.exe	31
PID 2520 wrote to memory of 2368	2520	svchost.exe	31
PID 2520 wrote to memory of 1544	2520	svchost.exe	32
PID 2520 wrote to memory of 1544	2520	svchost.exe	32
PID 2520 wrote to memory of 1544	2520	svchost.exe	32
PID 2520 wrote to memory of 1544	2520	svchost.exe	32
PID 2520 wrote to memory of 2324	2520	svchost.exe	36
PID 2520 wrote to memory of 2324	2520	svchost.exe	36
PID 2520 wrote to memory of 2324	2520	svchost.exe	36
PID 2520 wrote to memory of 2324	2520	svchost.exe	36
PID 2520 wrote to memory of 1712	2520	svchost.exe	38
PID 2520 wrote to memory of 1712	2520	svchost.exe	38
PID 2520 wrote to memory of 1712	2520	svchost.exe	38
PID 2520 wrote to memory of 1712	2520	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5dbca57b201b24cf86387e90b35b28a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2312
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:59 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1544
    - - C:\Windows\SysWOW64\at.exe
        
        at 07:00 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2324
    - - C:\Windows\SysWOW64\at.exe
        
        at 07:01 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
c739077aa011cfd5e6bd9c6773f48588

SHA1
998061551c4709b96b31fdcb3f86af86c919c6eb

SHA256
cc703a00f5c13290ef060a14e07f53c7197c5dd3fa445273a19dd832dc4d14e6

SHA512
e351ef09d6d4679fbaaf60b60651686aae53aff4535b372feabf1c5cf70051e56bc7fc97da5b269722644b4e9991a10fbe0977a6c9c5818d1af1fba932a2d299

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
755e787a5a942c795e5cc96ed40c4e0e

SHA1
9a23c56c9550f4dc160d90ce12300792fcaa6f2d

SHA256
a80cacd93e52ae8d2fbe0c12440c44c510527d305ec5c398ab15432e4b8a3602

SHA512
3f03273391a11ae0f806c379b6c8eb34b6ea313ee45929f5d0491d0e5681bd0108a47343b6b9de78054682be3a50d217aa4bea8c954d75ffed86ad2a98f91795

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
fcf10eb9dc56fc33d66dcb0cea7b90c1

SHA1
546d09f3d285607d07136d3fd20514acbdcf418e

SHA256
1546caab4a17d711e89cac8312b3a794cbbadaccd40acc9ccb0c26ca63dfc47b

SHA512
adf0ac5356ea4d0f18ce9c3bea12cecb56ec94bce3444edbc7f9d3616b787d2e9d2341d22dd8fda3647f36309b320e12398dcedc6f0ef6400908f14dddfe5504

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
1915d60ebd4d2a3a141526a5b1c6537f

SHA1
2f85a8efaad0d7f8d6b115ce1cf7e99af1465781

SHA256
8e776c710ae756795cd8da8572ea5d422d948d03e8a92f873bdf2f309dcd17cd

SHA512
fd47e3dec98eda36e7a4d1c875ca9172c2a34486b1ec43c944b9d67137576e29559a6bfd417e62bfed3dab58972a1e8f4c456ecd48e0f45ce7f5ffef623a1b24

Download Submit
memory/2312-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2312-35-0x0000000003130000-0x0000000003161000-memory.dmp

Filesize
196KB

Download
memory/2312-17-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2312-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2312-91-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2312-36-0x0000000003130000-0x0000000003161000-memory.dmp

Filesize
196KB

Download
memory/2368-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2368-65-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2484-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2484-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2484-37-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2520-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2520-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2520-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2520-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-78-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2556-20-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/2556-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2556-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2556-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2556-19-0x0000000002670000-0x00000000026A1000-memory.dmp

Filesize
196KB

Download
memory/2556-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2556-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download