Analysis

  • max time kernel
    12s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 22:08

General

  • Target

    1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232_NeikiAnalytics.exe

  • Size

    3.5MB

  • MD5

    e96f5b3730e7b90512efb76120718ac0

  • SHA1

    20e74ac3342fc556a478d5c996532e6f664f3952

  • SHA256

    1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232

  • SHA512

    c65bb48f47d46f954949c65d517d382dd4cea21eb2684a7282fdae36b9afb8d8d5c7e9e933da1709013cf2291b5778e7d285f86fc2921f6412627703943f61f8

  • SSDEEP

    98304:P66Nzf0vCNnowJAHzdZHG6efh3Bbob3+mFiP:7NTD+pZHG6efh3BDm0P

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2236
    • \??\c:\users\admin\appdata\local\temp\1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232_neikianalytics.exe 
      c:\users\admin\appdata\local\temp\1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232_neikianalytics.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2360
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2740
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2764
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1256
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2984
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2584
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:10 /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2568
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:11 /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:752
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:12 /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1264
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:2612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1de0d2f56e61a044f68fcb9bd111982a6c68bbcefc0587e81e9495bacecb7232_neikianalytics.exe 

      Filesize

      3.4MB

      MD5

      4ac6b7f3a1f778bfb9e97bdf7d71c0db

      SHA1

      b6fe449294ddafda2d269200fb9930d1b2e7b5f2

      SHA256

      1a90efb3a89c7ef2795d12de927e3123a30b278234c8c92ff0479767021b92a5

      SHA512

      1e44a65df80e240fb39880d6a8da8d6f815b0ac15ecd2838189f0a73ebc2854be0250b2ddb74b193d6f2225f9e3ea9cbeaf96c131400dc9dc11267fa8afc85ef

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      11c0e3f9d707fd7cdac52c1125e0bd34

      SHA1

      115e5264b90f5a2ff68bc8e94777b296af0cee86

      SHA256

      958a5e6e4d2dfd1a47924100c35817fb3dcb3916385465316a506d57451a3241

      SHA512

      d1f515067ec9be74ba4485c0aa266174d5d88546a91e8ab5234fe32be954020312da036a934d3424db61528026e83a85471dd9ee05d474f29ce8de6d7e45f770

    • C:\Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      3e95e3e774a7628a84caaf5f746cb4f0

      SHA1

      13b25155f094a7efbfa79d7a956eed24c2ecd480

      SHA256

      d0498b27e0b27d2ca9b6528f845bf4fd3f706d85d808411f8870b028fcf788a8

      SHA512

      cad4ad43cadbf099de1c1e707e4176542d0d85ecbea4339418b2fd1afc9d00ac6a63823975158d587eab5f8c6d42ad6df1c0f9784714b92869b9c8e8e06f70b4

    • \??\c:\windows\resources\themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      d932e116a4a1fc19a31d4a03d272cd39

      SHA1

      5375297fe87cba5b634d256622a7cc469391d56d

      SHA256

      1469ad8b900424e6124619b278f3315a4b834ca038a7e3d206e3144a62ed11c1

      SHA512

      a1e56ec7c357e11ea495a6684935ea91b2965995abde1dabd1ba123db54f8422195b4620eefc021cf0c31b1542dd3bacbe90216ea34e2ae851b804dedb911149

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      782aa15313a009f6dbe4ee5e88e3bf3c

      SHA1

      921c81d6a84a8c7bc34a26017ffe9e171cbc20d3

      SHA256

      3b444a28a40b5fcac01afe4746c9064d3cbc37f1f9fd6fac745488f548910a45

      SHA512

      2aaba0c1480fcac2bc1d0e98abe25c443d0abfd6ab79ed3a36b90034efa0918fb3f54cd291f772f468ae1545f5ac1642ff26b60ee44e66dc1c684aff210e0b5e

    • memory/1256-60-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2236-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2236-61-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2236-17-0x00000000002A0000-0x00000000002BF000-memory.dmp

      Filesize

      124KB

    • memory/2360-12-0x0000000000400000-0x00000000007B4000-memory.dmp

      Filesize

      3.7MB

    • memory/2360-11-0x0000000000340000-0x0000000000341000-memory.dmp

      Filesize

      4KB

    • memory/2584-59-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2740-62-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2740-28-0x0000000000440000-0x000000000045F000-memory.dmp

      Filesize

      124KB

    • memory/2984-53-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB