483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a

General

Target

483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Size

352KB
MD5

04fa6d8d01a6acb887a3ee37f26b27e0
SHA1

003fc3fea83e186b80dbb16c41c9286150ac0464
SHA256

483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a
SHA512

69393262df63f09b28a260668304431275dfa80a533f36f83fc31f7789efe33c25cbc91bfc6a293bac21914135239f2e082d26e3c0c08a206d2bc582b97c4ea8
SSDEEP

6144:ntKe6YiDdv3m3mgKHI3HWTXceq1bbLmRHcAVgL8zhYrT4yvZDZll:ntKe6Zv23YemcR1bbLmRNO8zyrTDNZ

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A4771DD-8B9A-11D5-EBA1-F78EEEEEE983}	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A4771DD-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msmqx32.exe"	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vcl32.exe	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\vcl32.exe	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\msmqx32.exe	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msmqx32.exe	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\concp32.exe	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\concp32.exe	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3556	4932	WerFault.exe	89

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A4771DD-8B9A-11D5-EBA1-F78EEEEEE983}	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A4771DD-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A4771DD-8B9A-11D5-EBA1-F78EEEEEE983}\sm = 01b8ec350471bd332433eee476ebe1f3	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A4771DD-8B9A-11D5-EBA1-F78EEEEEE983}\ax = 4d5baffd9814893c242101cc50b86957	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4932	483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\483070d9693222699f5c0a4ca47fb24198b8f6b44295bd6ef1559b9c442ec61a_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 744
  2⤵
  - Program crash
  PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2668,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4932 -ip 4932
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\concp32.exe

Filesize
360KB

MD5
e59bdd1547ce3dfaa478ef84dd3cf341

SHA1
08f2129405fa2bb719ee279da47b6146dfff6b8b

SHA256
92b051ce6a72c22becdddb406f1039a3c542795d71cf61e71598c08f039fd187

SHA512
187345ae46bf31365b4940be17147f7347d333fa663c65fbefa017c843ba1ddda6905bfd0d418af4de488d2f2c8bb5d3ade6eabce3dc42a1dea66dc4ac786f81

Download Submit
memory/4932-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4932-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads