67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe
Size

394KB
MD5

1d5b46715c043df4d2dcaf146f16c160
SHA1

60ad63e2478aad0c6359d046957c4269881bc916
SHA256

67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023
SHA512

9f2c551b46775f5dc3bb420615a1915470907ca5ca81c070f6bc7f803b898bebe193a2b8a5095097ea366621b1f3c2e4bb67e0d458dd1f8654d312085cb83c74
SSDEEP

12288:5RLSsPdKSsPdks8axVPxFJPGQeOixoTe0+:5RLSo4SoP8afPZeQJIoS7

Score

10^/10

evasion execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2408	Rundll32.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 9 IoCs

pid	Process
2204	Rundll32.exe
2204	Rundll32.exe
2204	Rundll32.exe
2204	Rundll32.exe
2408	Rundll32.exe
2408	Rundll32.exe
2408	Rundll32.exe
2408	Rundll32.exe
2408	Rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	Rundll32.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Rundll32.exe
File opened (read-only)	\??\F:	Rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xouctbtb.dll	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\chwctbtb.dll	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\KAV\CDriver.sys	Rundll32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1208	sc.exe
2964	sc.exe
2508	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2204	Rundll32.exe
2204	Rundll32.exe
2204	Rundll32.exe
2204	Rundll32.exe
2204	Rundll32.exe
2408	Rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2364 wrote to memory of 2204	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	28
PID 2204 wrote to memory of 2480	2204	Rundll32.exe	29
PID 2204 wrote to memory of 2480	2204	Rundll32.exe	29
PID 2204 wrote to memory of 2480	2204	Rundll32.exe	29
PID 2204 wrote to memory of 2480	2204	Rundll32.exe	29
PID 2204 wrote to memory of 2144	2204	Rundll32.exe	30
PID 2204 wrote to memory of 2144	2204	Rundll32.exe	30
PID 2204 wrote to memory of 2144	2204	Rundll32.exe	30
PID 2204 wrote to memory of 2144	2204	Rundll32.exe	30
PID 2204 wrote to memory of 1208	2204	Rundll32.exe	32
PID 2204 wrote to memory of 1208	2204	Rundll32.exe	32
PID 2204 wrote to memory of 1208	2204	Rundll32.exe	32
PID 2204 wrote to memory of 1208	2204	Rundll32.exe	32
PID 2204 wrote to memory of 2964	2204	Rundll32.exe	34
PID 2204 wrote to memory of 2964	2204	Rundll32.exe	34
PID 2204 wrote to memory of 2964	2204	Rundll32.exe	34
PID 2204 wrote to memory of 2964	2204	Rundll32.exe	34
PID 2480 wrote to memory of 2660	2480	net.exe	38
PID 2480 wrote to memory of 2660	2480	net.exe	38
PID 2480 wrote to memory of 2660	2480	net.exe	38
PID 2480 wrote to memory of 2660	2480	net.exe	38
PID 2144 wrote to memory of 2684	2144	net.exe	37
PID 2144 wrote to memory of 2684	2144	net.exe	37
PID 2144 wrote to memory of 2684	2144	net.exe	37
PID 2144 wrote to memory of 2684	2144	net.exe	37
PID 2204 wrote to memory of 2508	2204	Rundll32.exe	39
PID 2204 wrote to memory of 2508	2204	Rundll32.exe	39
PID 2204 wrote to memory of 2508	2204	Rundll32.exe	39
PID 2204 wrote to memory of 2508	2204	Rundll32.exe	39
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2408	2364	67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe	41

C:\Users\Admin\AppData\Local\Temp\67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\67e1f86aeab144b8ae451f17ddd36c37b55f7907dc4bd733a1b840e5cf236023_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\xouctbtb.dll Exucute
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:2660
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:2684
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1208
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2964
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    PID:2508
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32 C:\Windows\system32\chwctbtb.dll Exucute
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\chwctbtb.dll

Filesize
23KB

MD5
3ec0097815c1cbc8806a684756b218d6

SHA1
cc5c412023810ed506255f3d13740ca1865b192b

SHA256
2ed2a4a3405bdde9effe735c5a6df4aff71a2da380ef207947e5d65f82e6031e

SHA512
f55a781d76c60797373caca8d75d7a909e722e3a589477753d2169d4dca96a4eb0377d79d22e6fcd248cf82d1e946a300bb6e4f9db6d0e88b179b2251ff02019

Download Submit
C:\Windows\SysWOW64\xouctbtb.dll

Filesize
59KB

MD5
f26ca2f6846d3cdf60d54bc8ed39eaba

SHA1
de124e7c81c79408a578d891acfd13a1ddd9f391

SHA256
3b784ac577cd9140f8dc9bf08c506f2fd472e1aafdd95a386584408cde95a7d7

SHA512
fea242ee4ec5f2f2dca8dd15d550c3a9c7d95fd3f3ff639774d025f4914790df1a6deee66fa470d53a47385c2ae0f9bcfae81c5b47b44a1c2988bffa6a85bba3

Download Submit
\Users\Admin\AppData\Local\Temp\B08.tmp

Filesize
1.7MB

MD5
b5eb5bd3066959611e1f7a80fd6cc172

SHA1
6fb1532059212c840737b3f923a9c0b152c0887a

SHA256
1ffb68a66f28f604adcae9c135f8dcf301316ab7fda8ebd294583c56dd26f7cc

SHA512
6c0743e0ff4922e859ba66b68040ab994dbae33e80c63ce8c993ad31a0c7aad6c6467484da1550063214953cd641dbf597438dd0c02f24164505d88ca80ea1b6

Download Submit
memory/2364-9-0x0000000001060000-0x000000000107A000-memory.dmp

Filesize
104KB

Download