a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe
Size

244KB
MD5

fe90ef9fce7af5c7bc645f8da4ee2700
SHA1

88b624382b605c456f4f9cba3489c5a11a68d175
SHA256

a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c
SHA512

29eb668ca25b4283c7f1148f81478d1622b51d95e60f272dde8653c3462818c26339bd33075887e402c89630c8670b4bb86c6fe3aa1b09273eb49c47e4692137
SSDEEP

6144:jEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5EmX:kAylvv5YRwh9HYd61xhmX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
948	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\78def1c5 = "C:\\Windows\\apppatch\\svchost.exe"	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\78def1c5 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
768	948	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
948	svchost.exe
948	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4084	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 948	4084	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe	82
PID 4084 wrote to memory of 948	4084	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe	82
PID 4084 wrote to memory of 948	4084	a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a9b000bd7563ebd925be6924d7363be84c882b3eade51420baa154156837c04c_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 832
    3⤵
    - Program crash
    PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 948 -ip 948
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
244KB

MD5
6eb6a618f015bbd467929ad85f720156

SHA1
ab5a21d2bb0a7d6954d764dcf761a715545b5113

SHA256
3455237001e2367a1457085f68eaf2629a77042f404075ffe0918c83e695fce8

SHA512
95270f2cec3e9bc50f87bf5765fd0792d23e565039ce8fb1ed311b97b14d5d5b73bc27a819baf6762a0723c4d3441392051787ebeb576ef9dbc39c4c05e31f24

Download Submit
memory/948-13-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/948-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/948-17-0x00000000027A0000-0x00000000027EA000-memory.dmp

Filesize
296KB

Download
memory/948-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/948-19-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/948-23-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/948-22-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/948-26-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/4084-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4084-1-0x00000000020C0000-0x0000000002128000-memory.dmp

Filesize
416KB

Download
memory/4084-15-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4084-14-0x00000000020C0000-0x0000000002128000-memory.dmp

Filesize
416KB

Download
memory/4084-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download