e7ea1db041fdafca9206a3d884e1d322f4fc3efa0f910f20f4207fdf8b116406

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9eff1e07ea2c39c3b5ec52473a03a590_NeikiAnalytics.dll
Size 339KB
Sample240619-hj4jgswblb
SHA256 e7ea1db041fdafca9206a3d884e1d322f4fc3efa0f910f20f4207fdf8b116406
MD5 9eff1e07ea2c39c3b5ec52473a03a590
SHA1 eac764dcc50dff01ad759f1bb85954daa84bdac6
SHA512 d1b0dc38ffc2eaa83ef12563b16073687403897bb6dec0ab908fe72c2c982a487052b626057b385548c865747f2d36fd8ae6f90dcfa0a54b9b511cd04d6f4bda
SSDEEP 6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkG:PbtYapX0yrXG
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{8D38D28D-AF49-5AF4-6B16-05AF4AF49F49}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}\	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SJ.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SJ.dll	rundll32.exe
File created	C:\Windows\SysWOW64\YP.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\YP.dll	rundll32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}\InprocServer32\ = "C:\\Windows\\SysWow64\\SJ.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D38D28D-AF49-5AF4-6B16-05AF4AF49F49}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D38D28D-AF49-5AF4-6B16-05AF4AF49F49}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D38D28D-AF49-5AF4-6B16-05AF4AF49F49}\InprocServer32\ = "C:\\Windows\\SysWow64\\YP.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D27C27-49E3-F49E-05B0-AF49F49E49E3}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D38D28D-AF49-5AF4-6B16-05AF4AF49F49}\	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8D38D28D-AF49-5AF4-6B16-05AF4AF49F49}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2648	4708	rundll32.exe	82
PID 4708 wrote to memory of 2648	4708	rundll32.exe	82
PID 4708 wrote to memory of 2648	4708	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9eff1e07ea2c39c3b5ec52473a03a590_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9eff1e07ea2c39c3b5ec52473a03a590_NeikiAnalytics.dll,#1
  2⤵
  - Modifies Shared Task Scheduler registry keys
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SJ.dll

Path C:\Windows\SysWOW64\SJ.dll
Size 339KB
SHA256 30ead9fbae5677dab4fc1012b931b462d102a3c17b4bc71560b2413a6de95075
MD5 ec2f593a313b34e625ffb69dc57a5a76
SHA1 123509c241b61b2a5081dedb12061ba81e3220a3
SHA512 887736a9184714e0f4db7a21867122148a414daf115df43ba5ffd032cf5b8b91d54fc9df4560866a6aa47b5c31ef9cc9f471494d0308b7c82c9276e270e73393
SSDEEP 6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBky:PbtYapX0yrXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2648-17-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-20-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-12-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-13-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-14-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-15-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-11-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-18-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-16-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-19-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-0-0x0000000077974000-0x0000000077975000-memory.dmp

Download

memory/2648-21-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-22-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-23-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2648-24-0x0000000000400000-0x000000000045C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads