lucastealer | 916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe
Size

4.6MB
MD5

07bda3ceff510882df3327d40941aed0
SHA1

8883b99eb53e69dea6ca11a958865846aa1714a8
SHA256

916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c
SHA512

803bc046a5de28dcca0660f81adec585c49a46a2ae837c45d495c39805c5a313bce6d51a76f1db46df6d4715488221c0fb18a9aab2e76833faf42f3b9e19d9b3
SSDEEP

98304:z0trbTA1UjXLW6jRhdGVQguhhW31ZYit7nW:zac1UjL5LdGVzu+lHW

Score

10^/10

lucastealer evasion persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe

Executes dropped EXE 11 IoCs

Processes:

916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exeGPZJGM.exeTBPAQT.exegpzjgm.exe icsys.icn.exeexplorer.exe

pid	Process
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
5064	icsys.icn.exe
4524	explorer.exe
2548	spoolsv.exe
4268	svchost.exe
2944	spoolsv.exe
748	GPZJGM.exe
3100	TBPAQT.exe
5012	gpzjgm.exe
2504	icsys.icn.exe
2040	explorer.exe

Loads dropped DLL 1 IoCs

Processes:

TBPAQT.exe

pid	Process
3100	TBPAQT.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skyp\\Microsoft Update.lnk"	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023415-7.dat	autoit_exe

Drops file in Windows directory 6 IoCs

Processes:

svchost.exeexplorer.exeicsys.icn.exespoolsv.exe

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

icsys.icn.exe916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe explorer.exesvchost.exe

pid	Process
5064	icsys.icn.exe
5064	icsys.icn.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
4524	explorer.exe
4524	explorer.exe
4524	explorer.exe
4268	svchost.exe
4268	svchost.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid	Process
4524	explorer.exe
4268	svchost.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exeGPZJGM.exeicsys.icn.exeexplorer.exe

pid	Process
892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe
892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe
5064	icsys.icn.exe
5064	icsys.icn.exe
4524	explorer.exe
4524	explorer.exe
2548	spoolsv.exe
2548	spoolsv.exe
4268	svchost.exe
4268	svchost.exe
2944	spoolsv.exe
2944	spoolsv.exe
4524	explorer.exe
4524	explorer.exe
748	GPZJGM.exe
748	GPZJGM.exe
2504	icsys.icn.exe
2504	icsys.icn.exe
2040	explorer.exe
2040	explorer.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe GPZJGM.exeicsys.icn.exe

description	pid	Process	procid_target
PID 892 wrote to memory of 960	892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe	81
PID 892 wrote to memory of 960	892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe	81
PID 892 wrote to memory of 960	892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe	81
PID 892 wrote to memory of 5064	892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe	82
PID 892 wrote to memory of 5064	892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe	82
PID 892 wrote to memory of 5064	892	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe	82
PID 5064 wrote to memory of 4524	5064	icsys.icn.exe	83
PID 5064 wrote to memory of 4524	5064	icsys.icn.exe	83
PID 5064 wrote to memory of 4524	5064	icsys.icn.exe	83
PID 4524 wrote to memory of 2548	4524	explorer.exe	84
PID 4524 wrote to memory of 2548	4524	explorer.exe	84
PID 4524 wrote to memory of 2548	4524	explorer.exe	84
PID 2548 wrote to memory of 4268	2548	spoolsv.exe	85
PID 2548 wrote to memory of 4268	2548	spoolsv.exe	85
PID 2548 wrote to memory of 4268	2548	spoolsv.exe	85
PID 4268 wrote to memory of 2944	4268	svchost.exe	86
PID 4268 wrote to memory of 2944	4268	svchost.exe	86
PID 4268 wrote to memory of 2944	4268	svchost.exe	86
PID 4268 wrote to memory of 2468	4268	svchost.exe	87
PID 4268 wrote to memory of 2468	4268	svchost.exe	87
PID 4268 wrote to memory of 2468	4268	svchost.exe	87
PID 960 wrote to memory of 748	960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe	89
PID 960 wrote to memory of 748	960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe	89
PID 960 wrote to memory of 748	960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe	89
PID 960 wrote to memory of 3100	960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe	91
PID 960 wrote to memory of 3100	960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe	91
PID 960 wrote to memory of 3100	960	916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe	91
PID 748 wrote to memory of 5012	748	GPZJGM.exe	92
PID 748 wrote to memory of 5012	748	GPZJGM.exe	92
PID 748 wrote to memory of 2504	748	GPZJGM.exe	94
PID 748 wrote to memory of 2504	748	GPZJGM.exe	94
PID 748 wrote to memory of 2504	748	GPZJGM.exe	94
PID 2504 wrote to memory of 2040	2504	icsys.icn.exe	95
PID 2504 wrote to memory of 2040	2504	icsys.icn.exe	95
PID 2504 wrote to memory of 2040	2504	icsys.icn.exe	95
PID 4268 wrote to memory of 1964	4268	svchost.exe	104
PID 4268 wrote to memory of 1964	4268	svchost.exe	104
PID 4268 wrote to memory of 1964	4268	svchost.exe	104
PID 4268 wrote to memory of 2648	4268	svchost.exe	106
PID 4268 wrote to memory of 2648	4268	svchost.exe	106
PID 4268 wrote to memory of 2648	4268	svchost.exe	106

C:\Users\Admin\AppData\Local\Temp\916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- \??\c:\users\admin\appdata\local\temp\916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
  c:\users\admin\appdata\local\temp\916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Users\Admin\AppData\Local\Temp\GPZJGM.exe
    "C:\Users\Admin\AppData\Local\Temp\GPZJGM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:748
  - - \??\c:\users\admin\appdata\local\temp\gpzjgm.exe
      c:\users\admin\appdata\local\temp\gpzjgm.exe
      4⤵
      Executes dropped EXE
      PID:5012
  - - C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2504
    - - \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
- - C:\Users\Admin\AppData\Local\Temp\TBPAQT.exe
    "C:\Users\Admin\AppData\Local\Temp\TBPAQT.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3100
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5064
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2548
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4268
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
      - C:\Windows\SysWOW64\at.exe
        
        at 10:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:2468
      - C:\Windows\SysWOW64\at.exe
        
        at 10:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:1964
      - C:\Windows\SysWOW64\at.exe
        
        at 10:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\916b9fb0ab4159e30b8da7485c1d6f8a8ee228f29b853348fb87ccad1e5a865c_neikianalytics.exe

Filesize
4.4MB

MD5
148f58e5483475a8b2ab82baa3bf5688

SHA1
ef3742d4c9b4c4523824c24aa38868cabcf738be

SHA256
c322e74c1a9b98c99cbb7d7022aa67d9de388caec49e498a3465b905cbe26f01

SHA512
3d5d9e6cf10bf21396206401eec7245ec2d35a86b64bc47faca9d83b0acb2c56695b51cfbd3607c3723c51dde14ee8d6b521948b7a8bc95263ddda4aabef4b73

Download Submit
C:\Users\Admin\AppData\Local\Temp\GPZJGM.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut54F8.tmp

Filesize
63KB

MD5
07ca9ef8ca62bdfdcb8bd9b966d60bf2

SHA1
54bbb2bfd527ec503e66fe0db1c99a568c0240e8

SHA256
124a96831880a7f4ec1c70705466b9a48723ca387f7abc12f0d28d28a18edf20

SHA512
d0f0b0d5c01c0dcbc8458e509348f7e7969b87bd6261242e3488d9fef61f7e335f1fdcc9eb4bc777045202b6ebb5fa231fc39575f3da81163f82290e20b47e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
57KB

MD5
2fcac0a53e9aaffa146e751f8a1e1ae4

SHA1
cc074e73c8b50cf1973185188ed2c1ca630f01a3

SHA256
62dca27bfcf3cfab9fe834ca78278be7a53d8c1b485c0fa5051a86703fe79059

SHA512
b2cf9577ab0c9d002d52de15dceb9e52e11686649e9ff5d6a9fdc565eb7ee2aa2ae735cf0c8712c1dde895792542d3d0426624cc62b11f885357646e7e5f3ac6

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
b78b5638d0cf73afa5c869c5ca991501

SHA1
f3b1f9ec88d90dd73815e452b1ef22642f1d0db3

SHA256
b750df7fc7f54f51a4d804cb152b4b31248c2e55d2e5cf2bfa78434b508b78c2

SHA512
66836d0fed19d3eaa220b016169f67774fa855f93fb0f14758be7fe3a00c9f373e563cf435821f492c2db1c7edaf6c322c6ba2c64bf8d4b7794550789ba9c9a7

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
3e2253bbf2a1d51059e167b35b88e55b

SHA1
d2159a092df9f8084fa66ad8bf471d90f94ee2d7

SHA256
1cf82f6ddbbd15620c55fad8e90f00945f03a73f5b4bbd5fa4e48a89503c59f5

SHA512
cdc56e285c34f6d98e6141f8738f4fd468152c76539269bb9ec7f8aa95eb256e8ecebfa90db5922cb0bb7b52dee48037d2d346874c211e71d45b18eb88b8302e

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
99f58caf95630a9be4ec113fc5fe3077

SHA1
4593961dd9b65b613e66d82a3a5f1c9eb04b3409

SHA256
4164a59b6ac644c59db352495a6195cbc57dbce2c3924a45cd03aeb42691393b

SHA512
ba79ecf203f47355f6757d71ef96bd912376a8532aed1be440b04143cf3410996e77b696486d0013c8689adf56abbbeaa0b673660338a0f96b393fc7b2282df5

Download Submit
\??\PIPE\atsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\users\admin\appdata\local\temp\gpzjgm.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
a18481bc03cb96bdc6b16eac3c2bb18d

SHA1
cfe688e478d3f6da767287110c9290b5c0258d60

SHA256
d10ab659c415905f9b6784e0857a7a0ed8c028929b6f01f5fffe9cc941c9dcba

SHA512
315c1d1b4184a8768949e508943d47fe293248752966637574cb9b1efcdc9bf53df01314fc58591255ab6d3c687956e99b84a69d566678b6212bc004efe63154

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
9ae2cde9589e2d4b51a9799c751610df

SHA1
3d4e956faccc3397ce848d6a29ed6b0c3278903d

SHA256
65f69700689bda434047474a52dc8568a08a7fb4873d31182bb3f2c68dd0f63d

SHA512
e6b1ae373871f4edf9860b84e0df28028908c1f452f50f63b00eb0dbfc8d9b73a894462d3bb997dbdf3295761821391794d257bb75368f01595afb89c990e5aa

Download Submit
memory/748-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/748-117-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/892-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/892-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-115-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2504-116-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2548-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2944-51-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3100-96-0x0000000073FB0000-0x0000000073FD7000-memory.dmp

Filesize
156KB

Download
memory/5064-54-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5064-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download