Analysis
-
max time kernel
22s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 23:59
Static task
static1
Behavioral task
behavioral1
Sample
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe
-
Size
736KB
-
MD5
6f1fefa0d7c9fadfcfe9b410e1b4f310
-
SHA1
9ce4933ae761a9b409dfc0700869855ed733f57c
-
SHA256
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d
-
SHA512
7ca0e807272c936f6bec72b59e67ed140c6164c8b481bef2fc5bc66b6de381cf66a73ab8fb5ed23eeef0dc11634b62b7b0012fcdfcd21cc3cdde72e10aa97146
-
SSDEEP
12288:JTyjXW+48qWywrU4kGFezOAVuJ5PIiww7F5DO3HYffNknxWC:tIXW/8yw1ez54lIsF5SXYHNknYC
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
rundll32.exe27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 3484 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 3484 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/4060-1-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-8-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-3-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-14-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-15-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-12-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-9-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-16-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-18-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-20-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-21-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-24-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/4060-33-0x00000000034C0000-0x000000000454E000-memory.dmp upx behavioral2/memory/3484-50-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-49-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-58-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-54-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-51-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-60-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-57-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-56-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-47-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-55-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-65-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-64-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-66-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-68-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-67-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-70-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-71-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-72-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-73-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-75-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-77-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-79-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-82-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-84-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-86-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-98-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/3484-144-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx -
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe -
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\J: rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exepid process 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe 3484 rundll32.exe 3484 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Token: SeDebugPrivilege 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exepid process 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe 3484 rundll32.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription pid process target process PID 4060 wrote to memory of 796 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe fontdrvhost.exe PID 4060 wrote to memory of 804 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe fontdrvhost.exe PID 4060 wrote to memory of 316 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe dwm.exe PID 4060 wrote to memory of 2636 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe sihost.exe PID 4060 wrote to memory of 3120 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe svchost.exe PID 4060 wrote to memory of 3200 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe taskhostw.exe PID 4060 wrote to memory of 3500 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Explorer.EXE PID 4060 wrote to memory of 3628 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe svchost.exe PID 4060 wrote to memory of 3824 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe DllHost.exe PID 4060 wrote to memory of 3948 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 4060 wrote to memory of 4012 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe RuntimeBroker.exe PID 4060 wrote to memory of 4092 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe SearchApp.exe PID 4060 wrote to memory of 4140 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe RuntimeBroker.exe PID 4060 wrote to memory of 4288 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe RuntimeBroker.exe PID 4060 wrote to memory of 4544 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe TextInputHost.exe PID 4060 wrote to memory of 3484 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe rundll32.exe PID 4060 wrote to memory of 3484 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe rundll32.exe PID 4060 wrote to memory of 3484 4060 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe rundll32.exe PID 3484 wrote to memory of 796 3484 rundll32.exe fontdrvhost.exe PID 3484 wrote to memory of 804 3484 rundll32.exe fontdrvhost.exe PID 3484 wrote to memory of 316 3484 rundll32.exe dwm.exe PID 3484 wrote to memory of 2636 3484 rundll32.exe sihost.exe PID 3484 wrote to memory of 3120 3484 rundll32.exe svchost.exe PID 3484 wrote to memory of 3200 3484 rundll32.exe taskhostw.exe PID 3484 wrote to memory of 3500 3484 rundll32.exe Explorer.EXE PID 3484 wrote to memory of 3628 3484 rundll32.exe svchost.exe PID 3484 wrote to memory of 3824 3484 rundll32.exe DllHost.exe PID 3484 wrote to memory of 3948 3484 rundll32.exe StartMenuExperienceHost.exe PID 3484 wrote to memory of 4012 3484 rundll32.exe RuntimeBroker.exe PID 3484 wrote to memory of 4092 3484 rundll32.exe SearchApp.exe PID 3484 wrote to memory of 4140 3484 rundll32.exe RuntimeBroker.exe PID 3484 wrote to memory of 4288 3484 rundll32.exe RuntimeBroker.exe PID 3484 wrote to memory of 4544 3484 rundll32.exe TextInputHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3120
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3200
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4060 -
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3484
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4092
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4140
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4288
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4544
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
Filesize
736KB
MD56f1fefa0d7c9fadfcfe9b410e1b4f310
SHA19ce4933ae761a9b409dfc0700869855ed733f57c
SHA25627a4495eb63c13bbe2f8de34ed43b12fa2b27541d693f0830d3935548924c93d
SHA5127ca0e807272c936f6bec72b59e67ed140c6164c8b481bef2fc5bc66b6de381cf66a73ab8fb5ed23eeef0dc11634b62b7b0012fcdfcd21cc3cdde72e10aa97146
-
Filesize
256B
MD575d575952bde9cd7acbb405cb250ca13
SHA163177c93ca4fece85cda26d4a9460e8f43ea4a89
SHA2561c04ed851a2967b5ae387ec2129722c88b42dcfc18ac7ccdf9a297365d79b2b6
SHA5125ea40355b61a9a363ec22bf9d61fe144a51c3b64c16324577dc5b2a745f277ac21c7ee0a572854aeb1442504ca52e456974a3e8865bf4eccfe2496804c27b6cb
-
Filesize
100KB
MD51021a452feb2beaf0676a7e819f0b9b6
SHA1c542357f5e064d78885cee18adb5fb5fa63d2f93
SHA256aeba94164a4d97cad412c59db1068c2655405dead1d4cc6ed4e29fa703b5ffed
SHA5124a89c6e70fdebc8b30236410ffb5d7717d0689d8ea792d7a357766e7c5a63731944fbe56f7fc815d621b0d8a5aadf439359e30afcb2d08640ea6001eb461547e