Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 13:45
Static task
static1
Behavioral task
behavioral1
Sample
4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
4c57105730828c98c61e10949fc25950
-
SHA1
b018b8964a21ec971d7a8e3480ce28976012374c
-
SHA256
e3c9a1721d8f0eecf6a7e81b32b9823a4952d636d4930a9cdfae0876cf293d3b
-
SHA512
ead8b5fc20e1a9f2125f2f7338edc844f80415ef768f02753dcdc51140b811ae2fb60f0d77226418a433746a28c81296f1a8b41333eb6b7c59c9f52f82e1f378
-
SSDEEP
24576:8yqOw0U5IPpj5uiUgnhUaO6O/xaGRxr01X:rq50U5gpJUD6lGRp
Malware Config
Extracted
risepro
194.49.94.152
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 1Qe51ov4.exe -
Executes dropped EXE 2 IoCs
pid Process 4836 Ll7AZ90.exe 4044 1Qe51ov4.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Ll7AZ90.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 1Qe51ov4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3212 schtasks.exe 972 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4836 3540 4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe 82 PID 3540 wrote to memory of 4836 3540 4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe 82 PID 3540 wrote to memory of 4836 3540 4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe 82 PID 4836 wrote to memory of 4044 4836 Ll7AZ90.exe 83 PID 4836 wrote to memory of 4044 4836 Ll7AZ90.exe 83 PID 4836 wrote to memory of 4044 4836 Ll7AZ90.exe 83 PID 4044 wrote to memory of 3212 4044 1Qe51ov4.exe 85 PID 4044 wrote to memory of 3212 4044 1Qe51ov4.exe 85 PID 4044 wrote to memory of 3212 4044 1Qe51ov4.exe 85 PID 4044 wrote to memory of 972 4044 1Qe51ov4.exe 87 PID 4044 wrote to memory of 972 4044 1Qe51ov4.exe 87 PID 4044 wrote to memory of 972 4044 1Qe51ov4.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c57105730828c98c61e10949fc25950_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ll7AZ90.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ll7AZ90.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Qe51ov4.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Qe51ov4.exe3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:3212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
PID:972
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1005KB
MD580766f346a1033b1abfeeabc7180a880
SHA12568f835441d53bc785a4ddf8537814826e3d064
SHA25686a6beb6802f9ec2aa387143ba41461fb82783226223ba68b44e49b21c8d3d62
SHA512029d53c19dd434b410eb61158e8a653c3d3725b50de9e5bb7dd766baed93a37574b3171509ee7e968d18158d89082029e74881630fb852c37b305053ec5c87aa
-
Filesize
1.5MB
MD52554335d1d5d65d601b4d45a6e8aced2
SHA1db8d862c2eff246f13eb5a676fa15815f66673dd
SHA256f94b4a944d16a12fe45ec0e2c779607c1418dd789462e40d83dcf190496d4f80
SHA512a073dc2387ffd84143466136b0fd5c12ccd6a5d0bd67aa6d648d3f3790ee79028edd5d2ed8897437d794674dd46334d6cade72c91a0103d617285f5018c22fcb