Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 22:48
Behavioral task
behavioral1
Sample
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe
-
Size
90KB
-
MD5
ff6b6e18436baa89fea5ec3108c8fa90
-
SHA1
e994d2db5b75e837a358052608b1dd501ce94262
-
SHA256
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116
-
SHA512
ee44bafbe5df81f4e8ab3d9e2158adfeff467443c682430d55169e2540298bc981949d2887e741f3e51c2610317cd61181ee65b3e4894b26c3bbda775740630e
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2380-260-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
Processes:
csrsll.execsrsll.execsrsll.exepid process 1456 csrsll.exe 2276 csrsll.exe 2380 csrsll.exe -
Loads dropped DLL 5 IoCs
Processes:
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exepid process 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2192-78-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2192-86-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2192-91-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2192-81-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-103-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1780-104-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1780-100-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1780-96-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1780-94-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1780-107-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2192-108-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-106-0x0000000000400000-0x000000000040B000-memory.dmp upx \Users\Admin\AppData\Roaming\Microsoft\csrsll.exe upx behavioral1/memory/1456-150-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1780-148-0x0000000002750000-0x00000000027A3000-memory.dmp upx behavioral1/memory/1456-226-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2276-249-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1456-244-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2380-248-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1780-254-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2380-260-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2276-261-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.execsrsll.exedescription pid process target process PID 2192 set thread context of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 1456 set thread context of 2276 1456 csrsll.exe csrsll.exe PID 1456 set thread context of 2380 1456 csrsll.exe csrsll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
csrsll.exedescription pid process Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe Token: SeDebugPrivilege 2276 csrsll.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.execsrsll.execsrsll.exepid process 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 1456 csrsll.exe 2276 csrsll.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.execmd.execsrsll.exedescription pid process target process PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 2192 wrote to memory of 1780 2192 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe PID 1780 wrote to memory of 2140 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe cmd.exe PID 1780 wrote to memory of 2140 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe cmd.exe PID 1780 wrote to memory of 2140 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe cmd.exe PID 1780 wrote to memory of 2140 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe cmd.exe PID 2140 wrote to memory of 2384 2140 cmd.exe reg.exe PID 2140 wrote to memory of 2384 2140 cmd.exe reg.exe PID 2140 wrote to memory of 2384 2140 cmd.exe reg.exe PID 2140 wrote to memory of 2384 2140 cmd.exe reg.exe PID 1780 wrote to memory of 1456 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe csrsll.exe PID 1780 wrote to memory of 1456 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe csrsll.exe PID 1780 wrote to memory of 1456 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe csrsll.exe PID 1780 wrote to memory of 1456 1780 18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2276 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe PID 1456 wrote to memory of 2380 1456 csrsll.exe csrsll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18dd64b45b5c61964b14a52ff8859ddbd6941ccd386d0629779a7bf6ee287116_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DHXYV.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f4⤵
- Adds Run key to start application
PID:2384 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2276 -
C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"4⤵
- Executes dropped EXE
PID:2380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145B
MD54eb61ec7816c34ec8c125acadc57ec1b
SHA1b0015cc865c0bb1a027be663027d3829401a31cc
SHA25608375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff
SHA512f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1
-
Filesize
90KB
MD5fbed3473adae10d7c1d11457256669e8
SHA1bd4fdb78ed6324c7d74d411097abf81f0c718326
SHA2567431c4f5598bb2b12f89879a04ee615fbf528fdc56ce80a0186a9ef5228b0961
SHA512c438f88643e380de1590ae53ee0d0aada0626bd2a8f42497dfa93a32101a465df7c8ade76fb7be98b21fc6071bd6fca98c26e609d96532289a5f93d22ddbecaf