4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
Size

2.6MB
MD5

cd5e3e4dae1c6a68f46963b0feb76770
SHA1

d2bac6409ec52448379093ba990f4edde2624eb7
SHA256

4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4
SHA512

b5c9596501801e896d6a49e8f65d0ecc5a721bfc4e5530d468560a9112c0623175012b7acfe18594fe8d0a647e2b89a9c20380305f14a78f2d824a329cff121e
SSDEEP

12288:qCMYGmkOqYYf01bInqzHWI9WFEeapp3TXn8YoWSXLGzEoqAb8/DjUHhsAennZ5/I:qCmIYSbEDJUrTDw6aZWjvFtta8BuOh

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2600	taskmgr.exe
2692	taskmgr.exe
2704	taskmgr.exe

Loads dropped DLL 7 IoCs

pid	Process
1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
2600	taskmgr.exe
2600	taskmgr.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x0000000000699000-memory.dmp	upx
behavioral1/files/0x0007000000014b9e-27.dat	upx
behavioral1/memory/2704-62-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2704-61-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2600-58-0x0000000000400000-0x0000000000699000-memory.dmp	upx
behavioral1/memory/2704-57-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2600-44-0x0000000000400000-0x0000000000699000-memory.dmp	upx
behavioral1/memory/1924-43-0x0000000000400000-0x0000000000699000-memory.dmp	upx
behavioral1/memory/2704-76-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Task Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Task Manager\\taskmgr.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 2692	2600	taskmgr.exe	32
PID 2600 set thread context of 2704	2600	taskmgr.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2692	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	taskmgr.exe
Token: SeDebugPrivilege	2692	taskmgr.exe
Token: SeDebugPrivilege	2704	taskmgr.exe
Token: SeDebugPrivilege	3068	iexplore.exe
Token: SeDebugPrivilege	3068	iexplore.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
2600	taskmgr.exe
2704	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2608	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 2608	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 2608	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 2608	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	28
PID 2608 wrote to memory of 2720	2608	cmd.exe	30
PID 2608 wrote to memory of 2720	2608	cmd.exe	30
PID 2608 wrote to memory of 2720	2608	cmd.exe	30
PID 2608 wrote to memory of 2720	2608	cmd.exe	30
PID 1924 wrote to memory of 2600	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2600	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2600	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	31
PID 1924 wrote to memory of 2600	1924	4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe	31
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2692	2600	taskmgr.exe	32
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2600 wrote to memory of 2704	2600	taskmgr.exe	33
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34
PID 2692 wrote to memory of 3068	2692	taskmgr.exe	34

C:\Users\Admin\AppData\Local\Temp\4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sQuAx.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Task Manager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2720
- C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe
  "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe
    "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe
    "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sQuAx.bat

Filesize
170B

MD5
e612e66a93150f09e419dc23aa6ad30b

SHA1
aac69550ea153ff1b4550261675221c144b2da54

SHA256
c505222bbd299a60df2b8c9049866bc49e355f117a12f55fb1f5406d882f14ce

SHA512
51b236bc6b7c02a7babf61a1918a8f554f3d69762051943c8f712a68a7c1494e0a979efd6ebe49f1b4daae47d0e4c12652dcb16ac3e500565ba2dcbd16764e9f

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe

Filesize
2.6MB

MD5
595876b449f8cf940e16806c21d6ed5d

SHA1
506308b49404462435890ab302f627c4717d0dfb

SHA256
aa45311bf4b3d01138ac077175a47e261088182bba0eabbca07a8ae2363276f3

SHA512
85a9fd522b96a0ff1cea84f561a263ec9b3595cdcbaa1cabdc22805ef7ae6b072fbcd44c0d9a1e018c10c98ccc0f39daeb1723e609c1dca8118b7428d0aa5345

Download Submit
memory/1924-0-0x0000000000400000-0x0000000000699000-memory.dmp

Filesize
2.6MB

Download
memory/1924-43-0x0000000000400000-0x0000000000699000-memory.dmp

Filesize
2.6MB

Download
memory/2600-49-0x0000000002B10000-0x0000000002DA9000-memory.dmp

Filesize
2.6MB

Download
memory/2600-44-0x0000000000400000-0x0000000000699000-memory.dmp

Filesize
2.6MB

Download
memory/2600-58-0x0000000000400000-0x0000000000699000-memory.dmp

Filesize
2.6MB

Download
memory/2692-65-0x0000000010410000-0x000000001046C000-memory.dmp

Filesize
368KB

Download
memory/2692-50-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-52-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-66-0x0000000010410000-0x000000001046C000-memory.dmp

Filesize
368KB

Download
memory/2692-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2692-53-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2704-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2704-76-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download