359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
Size

736KB
MD5

eecacd56ecfa840bbefec50a630877f0
SHA1

ac5faf74478fd577adeb52626900f0615b39180e
SHA256

359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4
SHA512

24887971b9461ab2ccad5746c576fcb591058cef7c6a734580e75896d2cd92b87e6dd4503484700fdc19e6c1936b1ffdf2821596786db5a61c15d1a552fc9bae
SSDEEP

12288:kJLUNDaQer/5tX2M/qba+Jq3V8JZP+mALcdYJ0MAEe/gBjvrEH7d:klOaTrB92M/qbDhALcRMRe/CrEH7d

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000000b309-2.dat	acprotect

Executes dropped EXE 6 IoCs

pid	Process
2996	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_neikianalytics.exe
2672	icsys.icn.exe
2696	explorer.exe
2032	spoolsv.exe
2584	svchost.exe
2480	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
2672	icsys.icn.exe
2696	explorer.exe
2032	spoolsv.exe
2584	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1788-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x000500000000b309-2.dat	upx
behavioral1/memory/1788-71-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe
2228	schtasks.exe
276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2696	explorer.exe
2584	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
2672	icsys.icn.exe
2672	icsys.icn.exe
2696	explorer.exe
2696	explorer.exe
2032	spoolsv.exe
2032	spoolsv.exe
2584	svchost.exe
2584	svchost.exe
2480	spoolsv.exe
2480	spoolsv.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2996	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	28
PID 1788 wrote to memory of 2996	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	28
PID 1788 wrote to memory of 2996	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	28
PID 1788 wrote to memory of 2996	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	28
PID 1788 wrote to memory of 2672	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	29
PID 1788 wrote to memory of 2672	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	29
PID 1788 wrote to memory of 2672	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	29
PID 1788 wrote to memory of 2672	1788	359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe	29
PID 2672 wrote to memory of 2696	2672	icsys.icn.exe	30
PID 2672 wrote to memory of 2696	2672	icsys.icn.exe	30
PID 2672 wrote to memory of 2696	2672	icsys.icn.exe	30
PID 2672 wrote to memory of 2696	2672	icsys.icn.exe	30
PID 2696 wrote to memory of 2032	2696	explorer.exe	31
PID 2696 wrote to memory of 2032	2696	explorer.exe	31
PID 2696 wrote to memory of 2032	2696	explorer.exe	31
PID 2696 wrote to memory of 2032	2696	explorer.exe	31
PID 2032 wrote to memory of 2584	2032	spoolsv.exe	32
PID 2032 wrote to memory of 2584	2032	spoolsv.exe	32
PID 2032 wrote to memory of 2584	2032	spoolsv.exe	32
PID 2032 wrote to memory of 2584	2032	spoolsv.exe	32
PID 2584 wrote to memory of 2480	2584	svchost.exe	33
PID 2584 wrote to memory of 2480	2584	svchost.exe	33
PID 2584 wrote to memory of 2480	2584	svchost.exe	33
PID 2584 wrote to memory of 2480	2584	svchost.exe	33
PID 2696 wrote to memory of 2620	2696	explorer.exe	34
PID 2696 wrote to memory of 2620	2696	explorer.exe	34
PID 2696 wrote to memory of 2620	2696	explorer.exe	34
PID 2696 wrote to memory of 2620	2696	explorer.exe	34
PID 2584 wrote to memory of 3036	2584	svchost.exe	35
PID 2584 wrote to memory of 3036	2584	svchost.exe	35
PID 2584 wrote to memory of 3036	2584	svchost.exe	35
PID 2584 wrote to memory of 3036	2584	svchost.exe	35
PID 2584 wrote to memory of 2228	2584	svchost.exe	40
PID 2584 wrote to memory of 2228	2584	svchost.exe	40
PID 2584 wrote to memory of 2228	2584	svchost.exe	40
PID 2584 wrote to memory of 2228	2584	svchost.exe	40
PID 2584 wrote to memory of 276	2584	svchost.exe	42
PID 2584 wrote to memory of 276	2584	svchost.exe	42
PID 2584 wrote to memory of 276	2584	svchost.exe	42
PID 2584 wrote to memory of 276	2584	svchost.exe	42

C:\Users\Admin\AppData\Local\Temp\359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- \??\c:\users\admin\appdata\local\temp\359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_neikianalytics.exe
  c:\users\admin\appdata\local\temp\359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_neikianalytics.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2032
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:13 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3036
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:14 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2228
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:15 /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:276
  - - C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe
      4⤵
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\359c69d0183ac5a6ae43388910ac72099b3d1ee56ed9745931f306265a8dd0c4_neikianalytics.exe

Filesize
524KB

MD5
4c8eac2a3ecc7de96d8bbacf2b3b8760

SHA1
4369443ecd044a14f99a5be8ff56ca87fc87da6d

SHA256
c32cbcd7bec665237142eb48d6130fc05339702a1ea8250de7fbfc2a462d6304

SHA512
0b2411e84308415ca3644c0ddc81e7e87c2f162004e18b7325bf4e7c81ea350718cf901809a292c6b639c8e6f15ea1b6a10435bd9c6bec9280d992cf2a2255df

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
b72eaea0d880c27f200ffa781f38125d

SHA1
9d778ad55998640a2c3b43cabe47816c7cd158e0

SHA256
bda3b9dcbf641d4b760f9100d4f4fcea1e12df70cf863e9ae56ac5ca914ea3b0

SHA512
9ad35616112db3474e96b34b9b3ecbda49c835002f1b114f03436e6c198c93b4ac16b50c68f12a04877561a8a51a851b396c52c9f283f458d374d9148072b180

Download Submit
\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
3a2cde8407981066338f335dee59de6b

SHA1
24a8019b77dcae9ef514f46a4862624039a6b96a

SHA256
b21f9d78f387412d5609d87680c39c678aaea37fc6d27dad096f117d923d9dc4

SHA512
ec053289c1a204107e73d46f88b8e1056afa2fbeb64e36ca74a079f9e003f11c892847aefb6409e22e82579f2efb3eed409b5cdb76145a4d1e0f17a356c36648

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
8b17bd674026e792faa82ce2a328ef7d

SHA1
7b2616ca27cf54c67b8f618231aa7f4715543b96

SHA256
9426824241aca58a050659853ce9313e11c869ca59cb84c962dc5d36b461eae6

SHA512
6be581622500ee32c2f7e84b4568b262a805f4c2f5179b7c6c2062ed6e7ff517a03f16e26682a42ef6f3ef967b796fd1632829ac743a79e65cd88e6b00c1110f

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
cae0e7cb52323d3524b07545f8ec3772

SHA1
e115ed62a3910ba53a89a69eb801dcd24b9fa595

SHA256
fe6d473f15f871195ac85099c3db4f666bebb9c6c226d346f37dd28285ea8135

SHA512
a8b0f823b4bda33b27485d597a2d83e05c0ef247479f2a16c7ed0130118e5a95350d504b7c0e29fd7752aff93a63a35eebaf6d395747fcf260118923056395c3

Download Submit
memory/1788-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1788-71-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1788-25-0x0000000001C60000-0x0000000001C7F000-memory.dmp

Filesize
124KB

Download
memory/1788-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1788-70-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1788-11-0x0000000000408000-0x000000000040B000-memory.dmp

Filesize
12KB

Download
memory/2032-68-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2480-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2672-26-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2672-72-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2696-47-0x0000000000540000-0x000000000055F000-memory.dmp

Filesize
124KB

Download