29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe
Size

77KB
MD5

a4b0e6fa316324266df40be5a89085b0
SHA1

32c3abcb1d52ced517ba0bc42ca087f057e2033f
SHA256

29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7
SHA512

0eeb8b9618c9d5abdc0db2fd0db36cf94a4ec5421c07eb2ec63a31e410e1ef14adb877cc4c1463a69c56e0733b5b1df46bf87f5b6282a5468646dfe76fd3efe3
SSDEEP

1536:abSshapMJgKJUuxGmfJPtOgqm1s/XZSWcHH:K25KJFjfJPtOgqm2/XZXm

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2104	winlgon.exe

Loads dropped DLL 9 IoCs

pid	Process
2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe
2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe
3040	WerFault.exe
3040	WerFault.exe
3040	WerFault.exe
3040	WerFault.exe
3040	WerFault.exe
3040	WerFault.exe
3040	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3040	2104	WerFault.exe	28
2648	2060	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe
2104	winlgon.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2104	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 2104	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 2104	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	28
PID 2060 wrote to memory of 2104	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	28
PID 2104 wrote to memory of 3040	2104	winlgon.exe	29
PID 2104 wrote to memory of 3040	2104	winlgon.exe	29
PID 2104 wrote to memory of 3040	2104	winlgon.exe	29
PID 2104 wrote to memory of 3040	2104	winlgon.exe	29
PID 2060 wrote to memory of 2648	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	30
PID 2060 wrote to memory of 2648	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	30
PID 2060 wrote to memory of 2648	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	30
PID 2060 wrote to memory of 2648	2060	29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe	30

C:\Users\Admin\AppData\Local\Temp\29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\29f2e0c5fcce6367e78569536fb3435dc90933a6d1c20d1ecaf72127d75fdad7_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 256
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 204
  2⤵
  - Program crash
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\winlgon.exe

Filesize
77KB

MD5
7be76407611582989419728f674ca5af

SHA1
298d39df44eef6e33916c489a3333131b34dda3a

SHA256
053e7016e298aa362a5396d307b875cb03f736fde4e3296d567e8a4d08b4132b

SHA512
8332883dbdfef305fc65acd8715583c4984ea8ad7e1bf9daabbbed241e81a76bd7e59e442284ba33001705525e519149a199325abd36c0334c2f00137d05b08c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads