Overview

overview

8

Static

static

3

61ddbe58a2...cs.exe

windows7-x64

8

61ddbe58a2...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27/06/2024, 07:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    4d9a1f961f123af9a70d205aadab0840

  • SHA1

    3a13b0822fbba0a5518126e7de06d3e7ebdf00bd

  • SHA256

    61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb

  • SHA512

    1044ce436c414b46375492054aa911bab0c54f529a037e602a16ba88fd4be4ba086b35f52a9412d1be4071306447dfb49d51828601a329dd671fc45870e90793

  • SSDEEP

    24576:E6UeWKwmEpuXRGEUHkT86JdNFtGvMy/E8vQsJfyqoNP1zk:E6UVKQpgo1kjJavJuufyqoNdk

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2968
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1668
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2128
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 57D0BBD46E17FC52C786E1F8A429A818 C
      2⤵
      • Loads dropped DLL
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabF7D.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI1446.tmp
    Filesize

    57KB

    MD5

    c23d4d5a87e08f8a822ad5a8dbd69592

    SHA1

    317df555bc309dace46ae5c5589bec53ea8f137e

    SHA256

    6d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27

    SHA512

    fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI1485.tmp
    Filesize

    105KB

    MD5

    5509621dca088ef52ffb084bd8af7eb3

    SHA1

    7156ecd85dad51b1f933da185a7f1346410c2a8d

    SHA256

    bdaa83c4f5ea72c4e81d805cdb30ad0394061e0048d926b09be9b77db74f3726

    SHA512

    89b43a9ef904014bec8f6c044fcc25fa00fd1b99c97c0ce6f680de2dda2a5d06b75058d96d3b0341f62c00f5316bead16c8e3978bab9373ffb95918b4c1293f0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI14B5.tmp
    Filesize

    295KB

    MD5

    95ed4d4025ba60e4aa41128574895b02

    SHA1

    760149b78574fcbf17ef871dec76cb7f4adac99f

    SHA256

    25b004d5aa7b1f1c9dc4ae62ff8c8015b6a48da059483f2ab8f6458718256bd3

    SHA512

    0b4126a0bf274304ef0c38a462ad0999e832915ff423040746f9452d226074c7a1ffab8de1b40c32959ccdfa60e4b7d2335c014043ef5f7993a6cc2ffccd4c2e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI1533.tmp
    Filesize

    207KB

    MD5

    c6e7c1fa4c99ac76a9484c0dc7b056d8

    SHA1

    a0fb23fd111fa7b5d08655a3a049359b42ad09ea

    SHA256

    53aff70e75afe582b5983c62bec71905617b1029721ccfa80130e1cb5b883b3d

    SHA512

    8de5f2fb50dee154d44b579b1e8b969c543df26ea22bd3089c8c2fe0e4e641fac67e5e101e4feaece940b3ff36d7e6d084ea2aa0e3a26543b7c92a2afcf04ec9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarF9F.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\AE 0124 BE.msi
    Filesize

    2.7MB

    MD5

    d519ffc109be810f2d1596612b8b1890

    SHA1

    13458dcbc227780bd0e7c1ef3f0691d992bd9589

    SHA256

    faa633656d1f649c6d7731d13b0c09d981560841a1b736ddca16845c5a5552be

    SHA512

    2f2b16b8f230c46d1d5e8b328fc91ea96548841e73365fb4022fd412ce87a49c2f0032d94b900693d4388ba7463ddce63ebe4ab524efad475e8e8c651a315a4c

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • \Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    130KB

    MD5

    1ca05dd9a829256fd297ecebb3d922f8

    SHA1

    3c2fd4d8d071780c8b2b15739d8795e17dd5493e

    SHA256

    e9d1b72d6dd30fe495815bfc1ad7a5dd5017aa10eb8785c2c00edd890a1f292c

    SHA512

    6b6820e8217a68d91c1b2bf36a934e7e3e4e29a744d2ee689bf85a9b6231424a0e03bc707ac7f9030d6e5ff78530203888b55d121ffc75323074b905c35e76a2

    Download Submit

  • memory/1732-12-0x0000000004040000-0x0000000004AFA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2240-81-0x0000000003360000-0x0000000003E1A000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2240-411-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2240-420-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2604-76-0x0000000003510000-0x0000000003FCA000-memory.dmp

    Filesize

    10.7MB

    Download