Analysis
-
max time kernel
22s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe
-
Size
112KB
-
MD5
0ca7aa0612159edcb3f9f8aa0a06a560
-
SHA1
e0c5f769388794a221b0b4f49ff0910fcd1ec2c9
-
SHA256
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59
-
SHA512
b54ee87bdeb8ecd9f38ca5cfe50d7c28777a39daef4dc8f4b5ba49a80490d7cbf59629b900e696b1f8271d77db81682a7b205b189bab7d81c06886d3dd2dc44d
-
SSDEEP
1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3652-59-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3652-57-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3652-56-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 behavioral2/memory/3652-66-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
WAMain.exeWAMain.exeWAMain.exepid process 5068 WAMain.exe 4992 WAMain.exe 3652 WAMain.exe -
Processes:
resource yara_rule behavioral2/memory/4724-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4724-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4724-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3652-59-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3652-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3652-56-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3652-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/3652-53-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral2/memory/4724-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4992-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3652-66-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exeWAMain.exedescription pid process target process PID 1896 set thread context of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 set thread context of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 5068 set thread context of 4872 5068 WAMain.exe svchost.exe PID 5068 set thread context of 4992 5068 WAMain.exe WAMain.exe PID 5068 set thread context of 3652 5068 WAMain.exe WAMain.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe 620 svchost.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
WAMain.exedescription pid process Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe Token: SeDebugPrivilege 4992 WAMain.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exesvchost.exe2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exeWAMain.exesvchost.exeWAMain.exepid process 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 620 svchost.exe 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 5068 WAMain.exe 4872 svchost.exe 4992 WAMain.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.execmd.exeWAMain.exedescription pid process target process PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 620 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe svchost.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 1896 wrote to memory of 4724 1896 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe PID 4724 wrote to memory of 3696 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe cmd.exe PID 4724 wrote to memory of 3696 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe cmd.exe PID 4724 wrote to memory of 3696 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe cmd.exe PID 3696 wrote to memory of 2588 3696 cmd.exe reg.exe PID 3696 wrote to memory of 2588 3696 cmd.exe reg.exe PID 3696 wrote to memory of 2588 3696 cmd.exe reg.exe PID 4724 wrote to memory of 5068 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe WAMain.exe PID 4724 wrote to memory of 5068 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe WAMain.exe PID 4724 wrote to memory of 5068 4724 2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe WAMain.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4872 5068 WAMain.exe svchost.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 4992 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe PID 5068 wrote to memory of 3652 5068 WAMain.exe WAMain.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2986a47ecfbf3b8307675ec1f6ddfcef3880127e961b698fd3d990984c333a59_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DGRTO.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DGRTO.txtFilesize
148B
MD53a4614705555abb049c3298e61170b7f
SHA1c8686410756f346d9551256a5b878b04770950ba
SHA256cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b
SHA51265ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007
-
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exeFilesize
112KB
MD583c05afc59bc1fed068f6a2cee7f0541
SHA16b5301f2cebb91a020eda3e028ca916bf4f66472
SHA256f4f872ce9e420644541228c157f06328ba642117cd39c26887301561b66315d9
SHA512afced8b321120b538e588ad590f5abf6861225024f9443d631080c412cdadb606dbae4bf3761a36c8818d0a2469c7df3c068a13d480851d34c8af7750b4c9add
-
memory/620-13-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/620-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/620-69-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/620-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/620-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1896-2-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/3652-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-66-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-53-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-55-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3652-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4724-62-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4724-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4724-14-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/4724-64-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/4724-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4724-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4872-41-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4872-47-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/4872-43-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4872-78-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/4992-58-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB
-
memory/4992-65-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5068-40-0x00007FFF07090000-0x00007FFF07285000-memory.dmpFilesize
2.0MB