3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281

General

Target

3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe
Size

3.4MB
MD5

9c26a81a4e07480102b8866c41ecb900
SHA1

586a3de0d843ab7022cbda769fdd2237d3a635c9
SHA256

3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281
SHA512

4e51960aa6f193b22b9563682ff51bc1f6e917e9260ed846e578412f229c2b6a83a9b9392b9c0e978dedc33ec5ea9e5b422894659603e9a19ae7a56a0934e372
SSDEEP

98304:WkkLESftZrW41TNqFrxLDKSMJ/Og4vf2OxmhOvGY6eXsx:hAESTTNq9uJ/Og4XPmoeYBXsx

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1908	Install LOLInfo.exe

Loads dropped DLL 4 IoCs

pid	Process
2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe
2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe
2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe
2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Install LOLInfo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Install LOLInfo.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 1908	2204	3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3ef59aa8de1804218108a1f343ad753f71219d32bc10370d27efaed89b744281_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\AIRFBA.tmp\Install LOLInfo.exe
  "C:\Users\Admin\AppData\Local\Temp\AIRFBA.tmp\Install LOLInfo.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:1908

Network

DNS

airdownload.adobe.com

Install LOLInfo.exe

Remote address:

8.8.8.8:53

Request

airdownload.adobe.com

IN A

Response

airdownload.adobe.com

IN CNAME

ssl-download.adobe.com.edgekey.net

ssl-download.adobe.com.edgekey.net

IN CNAME

e4578.dscd.akamaiedge.net

e4578.dscd.akamaiedge.net

IN A

2.21.188.171
GET

http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer

Install LOLInfo.exe

Remote address:

2.21.188.171:80

Request

GET /air/3/nai/windows6.1/x86/installer HTTP/1.1
User-Agent: Adobe AIR Bootstrapper13.0.0.83
Host: airdownload.adobe.com
Cache-Control: no-cache

Response

HTTP/1.1 301 Moved Permanently

Server: AkamaiGHost
Content-Length: 0
Location: https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer
Date: Thu, 20 Jun 2024 06:26:27 GMT
Connection: keep-alive
GET

http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7

Install LOLInfo.exe

Remote address:

2.21.188.171:80

Request

GET /air/3/nai/windows6.1/x86/installer.p7 HTTP/1.1
User-Agent: Adobe AIR Bootstrapper13.0.0.83
Host: airdownload.adobe.com
Cache-Control: no-cache

Response

HTTP/1.1 301 Moved Permanently

Server: AkamaiGHost
Content-Length: 0
Location: https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7
Date: Thu, 20 Jun 2024 06:26:29 GMT
Connection: keep-alive
GET

https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer

Install LOLInfo.exe

Remote address:

2.21.188.171:443

Request

GET /air/3/nai/windows6.1/x86/installer HTTP/1.1
User-Agent: Adobe AIR Bootstrapper13.0.0.83
Connection: Keep-Alive
Cache-Control: no-cache
Host: airdownload.adobe.com

Response

HTTP/1.1 200 OK

Server: Apache
Last-Modified: Mon, 24 Jun 2019 13:26:24 GMT
ETag: "b02458-58c11c23e8eab"
Accept-Ranges: bytes
Content-Length: 11543640
Date: Thu, 20 Jun 2024 06:26:27 GMT
Connection: keep-alive
GET

https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7

Install LOLInfo.exe

Remote address:

2.21.188.171:443

Request

GET /air/3/nai/windows6.1/x86/installer.p7 HTTP/1.1
User-Agent: Adobe AIR Bootstrapper13.0.0.83
Connection: Keep-Alive
Cache-Control: no-cache
Host: airdownload.adobe.com

Response

HTTP/1.1 200 OK

Server: Apache
Last-Modified: Mon, 24 Jun 2019 13:26:24 GMT
ETag: "f14-58c11c2413c9b"
Accept-Ranges: bytes
Content-Length: 3860
Date: Thu, 20 Jun 2024 06:26:29 GMT
Connection: keep-alive

2.21.188.171:80

http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7

http

Install LOLInfo.exe

621 B
597 B
7
4

HTTP Request

GET http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer

HTTP Response

301

HTTP Request

GET http://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7

HTTP Response

301
2.21.188.171:443

https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7

tls, http

Install LOLInfo.exe

597.3kB
13.9MB
8532
9950

HTTP Request

GET https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer

HTTP Response

200

HTTP Request

GET https://airdownload.adobe.com/air/3/nai/windows6.1/x86/installer.p7

HTTP Response

200

8.8.8.8:53

airdownload.adobe.com

dns

Install LOLInfo.exe

67 B
167 B
1
1

DNS Request

airdownload.adobe.com

DNS Response

2.21.188.171

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AIRFBA.tmp\.launch

Filesize
19B

MD5
a59504597a32f93007beef70faadca35

SHA1
d5d708fdae84d4fc18ca48c4cdbf999a87dc7efd

SHA256
8aa4d5331fd928a41f15280f6d7bc2e8e6d8b7be913a83063e001224b7c80d03

SHA512
f97f691ef124636a62a133328036103ab9d2fa6c08f6203211cf61f8b74faf474d35de54c20e326276746f231a9f0e193d96530361e89957c95f9731c6bf1b4f

Download Submit
\Users\Admin\AppData\Local\Temp\AIRFBA.tmp\Install LOLInfo.exe

Filesize
129KB

MD5
f20ad78598c39c35ae6e7595444cdc76

SHA1
1c586ca02dc7eb0924c6538e7a1c0e17cac9e7be

SHA256
adc2cb614008caf3250cda012370b099341f1ddf482aeb3b45a8736f27de13c7

SHA512
ca7b6f89c6acde6c3c2143d4ad3c9b9a4ccd4de677c410bbdf5ca1341cc40af19ff5aef73170a4501302ab0b04883c020cf3a31c1db83eae8c027ab0a7193963

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.