Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
466c23db312d56ba3de27d352aa1f030
-
SHA1
f3e0c6d0eff8a353bd719f9f8490ef2c499f0640
-
SHA256
243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a
-
SHA512
1b17f19a0b1b6e7173aba0b345125e92404faffc97b5271f04cac84c998c26b0fb532db554c50545a5b964dc84f959898de6d140dfdda212dcf80799bf0675ce
-
SSDEEP
49152:1HxV328apDQWu/YXFPD+pgTtd24i9tOXVOsVPqVP84zA1lBOxoduYkkJed7KoWmG:1RzCI/YXOg5d240tOXssVPe840BOxodD
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1580 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe 4332 DesktopLayer.exe -
Loads dropped DLL 20 IoCs
pid Process 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/1580-5-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/files/0x000a0000000233f2-6.dat upx behavioral2/memory/1580-11-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4332-35-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4332-76-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px4B03.tmp 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{49D23CB9-334B-11EF-BCA5-F2AC8AF4D319} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425520271" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4332 DesktopLayer.exe 4332 DesktopLayer.exe 4332 DesktopLayer.exe 4332 DesktopLayer.exe 4332 DesktopLayer.exe 4332 DesktopLayer.exe 4332 DesktopLayer.exe 4332 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2260 iexplore.exe 2260 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 440 wrote to memory of 1580 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 83 PID 440 wrote to memory of 1580 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 83 PID 440 wrote to memory of 1580 440 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe 83 PID 1580 wrote to memory of 4332 1580 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe 84 PID 1580 wrote to memory of 4332 1580 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe 84 PID 1580 wrote to memory of 4332 1580 243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe 84 PID 4332 wrote to memory of 2260 4332 DesktopLayer.exe 85 PID 4332 wrote to memory of 2260 4332 DesktopLayer.exe 85 PID 2260 wrote to memory of 2584 2260 iexplore.exe 86 PID 2260 wrote to memory of 2584 2260 iexplore.exe 86 PID 2260 wrote to memory of 2584 2260 iexplore.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exeC:\Users\Admin\AppData\Local\Temp\243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\243824359fb624a558cb8fa4648f1f3d3fa9385b2a83b608fef4175bc1c3ff9a_NeikiAnalyticsSrv.exe
Filesize55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
796KB
MD50a319eb1d56bb802d29db7b0882b0d4b
SHA1538b7d475d5a068b98afc6a98bef349d72b16d0f
SHA25637c38a5e0d85cb10ff6f68829bc848b27f312e7d95d4c8edcc0fb85366477b7f
SHA512e6b0f96b58da2e80ca729cb84489b1716e231ddeef66939c1762afc6b5d3914bfd6727041fc170e2f9964edb0b53bd3b4a8ef2fbb81289984898bd703b617ad8
-
Filesize
32KB
MD513ddf9b2dce1fd240486bf7f9f8cb21e
SHA16c870fe5075963d7e43197ec154bf00523d0fa5a
SHA256dff275458c470e66ad5c6e76def73dda394a1a3624f794da78f07c6257b876c2
SHA512e003c752456679793fb658dbe57b23016bec6f9fdf80a4c7174e03c842133889aa9da16558c24606c885a213477e6bdbc8d32acecdb7a7925bdc10340f882425
-
Filesize
24KB
MD514d6b35664bf47c1984722da0acaa7bb
SHA159eb0f4cba1514d44148588e485398667bb5f775
SHA256b370379b86f6dce6873fb170a6385fcac87f3fda0aa8f9caeecaaa4bc330f84d
SHA5129583759c2e7604662ff9444094fc332219d53ebd9aab205dbd66fd11203adfd71d4007676f2841a7a7f7a5835766d5bef4a90825cc772147d500580cb5d2b462
-
Filesize
36KB
MD51996b48458b3fe66c7ff11cb53f23c43
SHA1035d8b86c68e80537ade315ebac842643472cb0e
SHA2569014060197b24a96bfa08cae7780b948bd4df1c73a1197de3a11f2ddaa2eaca9
SHA512b6afdd010ef8a5709bd79c43519088688a56cb5838875f26039abb583b6f67db8fafaf1f0b2a1589e00a101c981b48b5438ce821686bbfc0e4f7ec37b5e1f181
-
Filesize
20KB
MD51ea70e44b6d1df8254c514cde11a5f3b
SHA1d387b307c569112074980f6140e2aee57c223655
SHA256c4b1bc9a677e960db4b5182c5917adbdcae14e177f5734b2ea77d2e7726995f3
SHA51204ddfabbd07b0e33f9134c8d6e419f9d3e0f1546df10d70a2c77ae48799e6ae5ffdc6df78a8c1e43f02bd12d615d2916bf0809c21e5ab3a6bdb4542faaf439fc
-
Filesize
28KB
MD55457f9191e7a7dbd7ae41defd02457e6
SHA1141f08e8d14f4e21a15f5808bc55b37168e84571
SHA256970c5dcbefa446f8f35b58470e1cb5984ae987de409390a6b6c1b40a85e3b588
SHA51203ef6c85a1503af4fe8371fcd98aafa99328545adb1280c6cde33296ddf538b20dd37bdfb2fa6b81681c168e170171effe5143bb0e57c51a4c483dd9d87a5bea
-
Filesize
584KB
MD5611242ee7a1c406283edfb1ce2f9dcf1
SHA1762444790231dc08b6dabb474ed5f0dc782d65a8
SHA256f790ef2dac6b4cd4d706c4b86dff137de24560077cb060f1da0b64d3278cabf0
SHA512fe96cbeec3fe6ff40632d7c080285cbde2c3d5398ef32bf0a44d0bf80c2aad4365a674970ce81a0be5c62dfaa489f6d891d196028ab165ed885c430da6b5f197
-
Filesize
32KB
MD575f29543113df21eb90d1aefa0207222
SHA148a224022b8a9c0a35e703adf26f87929395e6ee
SHA2566a36a40cd624891dfea7131b62c5ee6fcb4cf5d3ba4022cc47a58486dd17b111
SHA51239689701e0c051020285c76335c6164b57541a3c35d15048ce4606496fca3f237925a29489992181f61dc05beddb6f78114a759efcfebdd970aa94ed0a2c0e87
-
Filesize
40KB
MD584f764ccae4d5d7b117c169a67858331
SHA1be7d2889ca6648a6e91132d3a824e9a5ebcc2781
SHA256e7a7da5efd0334c2c591e35147b35df3dcae26d9a30a0a7d5deca559f6ba941d
SHA512e1a9d53a899312ad1b4e6c4841364ba7bb07f7d3644088912147f41fa2e65730bd17c992f1b84ac2c917e3acd3df1612b9341138e8f48cbd189e582f1ba1e16a
-
Filesize
712KB
MD59e63828c53d7cd2b1bf30ffbce951400
SHA15984f6aad00b4cb52c58be7e9a3d63c653b9a10f
SHA256b7ada205047d833c3d5e4fe8ee34de18260c5ab05b34fd0e16dc154a4769520b
SHA512d53de2f37473db8538da3db37d3de19742a59171ce6bcd4b3f90ffd6f37d534c090cb6dbf620b3e01619ef58ef8dd835fa812cb9e94b84b1f007d14df21eb6f7
-
Filesize
48KB
MD5b12199ec1810c8921c6f3e4fde40ff2b
SHA1530a1ccd39de785771c30aa175ab94a3f085c21a
SHA2564f4bba152d16c05824ff1ebe4d8b2b52365ac745b45ef2b7ded13fbf1bf4a8c7
SHA512af244a32e39686f8876400963c33a0a297c797fd80b3b3a535de6abdd9584b5cc3fdd7b2934e636392bc8fd5d9fe81e4b9bc25b642b4f58646e341de72f19a6c