Overview

overview

8

Static

static

3

61ddbe58a2...cs.exe

windows7-x64

8

61ddbe58a2...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 07:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    4d9a1f961f123af9a70d205aadab0840

  • SHA1

    3a13b0822fbba0a5518126e7de06d3e7ebdf00bd

  • SHA256

    61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb

  • SHA512

    1044ce436c414b46375492054aa911bab0c54f529a037e602a16ba88fd4be4ba086b35f52a9412d1be4071306447dfb49d51828601a329dd671fc45870e90793

  • SSDEEP

    24576:E6UeWKwmEpuXRGEUHkT86JdNFtGvMy/E8vQsJfyqoNP1zk:E6UVKQpgo1kjJavJuufyqoNdk

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 39 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops desktop.ini file(s) 57 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\61ddbe58a2fa6e96c433a267f3886ed259900ac878451a5ce2aab2d984e48bcb_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:636
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:776
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3612
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0EBDCDB4BB1859A09785D69C02B7289E C
      2⤵
      • Loads dropped DLL
      PID:4028

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\MSI77C0.tmp
          Filesize

          57KB

          MD5

          c23d4d5a87e08f8a822ad5a8dbd69592

          SHA1

          317df555bc309dace46ae5c5589bec53ea8f137e

          SHA256

          6d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27

          SHA512

          fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\MSI787D.tmp
          Filesize

          418KB

          MD5

          67f23a38c85856e8a20e815c548cd424

          SHA1

          16e8959c52f983e83f688f4cce3487364b1ffd10

          SHA256

          f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

          SHA512

          41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\MSI78CD.tmp
          Filesize

          209KB

          MD5

          0e91605ee2395145d077adb643609085

          SHA1

          303263aa6889013ce889bd4ea0324acdf35f29f2

          SHA256

          5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

          SHA512

          3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

          Download Submit

        • C:\Windows\AE 0124 BE.msi
          Filesize

          2.7MB

          MD5

          d519ffc109be810f2d1596612b8b1890

          SHA1

          13458dcbc227780bd0e7c1ef3f0691d992bd9589

          SHA256

          faa633656d1f649c6d7731d13b0c09d981560841a1b736ddca16845c5a5552be

          SHA512

          2f2b16b8f230c46d1d5e8b328fc91ea96548841e73365fb4022fd412ce87a49c2f0032d94b900693d4388ba7463ddce63ebe4ab524efad475e8e8c651a315a4c

          Download Submit

        • C:\Windows\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          130KB

          MD5

          1ca05dd9a829256fd297ecebb3d922f8

          SHA1

          3c2fd4d8d071780c8b2b15739d8795e17dd5493e

          SHA256

          e9d1b72d6dd30fe495815bfc1ad7a5dd5017aa10eb8785c2c00edd890a1f292c

          SHA512

          6b6820e8217a68d91c1b2bf36a934e7e3e4e29a744d2ee689bf85a9b6231424a0e03bc707ac7f9030d6e5ff78530203888b55d121ffc75323074b905c35e76a2

          Download Submit

        • C:\Windows\System32\LogFiles\WMI\CloudExperienceHostOobe.etl.002
          Filesize

          256KB

          MD5

          26450c1ac9820c708096dc2892542a35

          SHA1

          33ab6adcfab4ba1b2fd67db89818a6bfa6ecc48e

          SHA256

          6a3779956c62b0f3ffa0530b191c91bef6f393222e49ec8ad9e916f6feff7dc2

          SHA512

          18eeec31e53c73235cb8025a1c274426467979f3c36058f46079cacb092dd47b4badab12d5b9a6b231c8eb6d4650f32957215dca73b0813e5ba9437794dd4be2

          Download Submit

        • \??\c:\B1uv3nth3x1.diz
          Filesize

          21B

          MD5

          9cceaa243c5d161e1ce41c7dad1903dd

          SHA1

          e3da72675df53fffa781d4377d1d62116eafb35b

          SHA256

          814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

          SHA512

          af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

          Download Submit