Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10-05-2024 23:52
General
-
Target
3212eb39245116d7bea52a73678c80b0_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
3212eb39245116d7bea52a73678c80b0
-
SHA1
2dfd178f121ec3812ac37efcc236fb598322556e
-
SHA256
14e23f77ad04c2b0b1ad19ba0f3c550fe08d4fdfbcc075cb8213e62d163eddc6
-
SHA512
9c0e03e7528409326ee1574ff0b80b5381ff601ef17ce2bbaf76fe3d3ac52791a48a21f9037a01df4c9b9b8278fbc499bec12c356d23ecb755b0628689c9106e
-
SSDEEP
49152:txmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxp:txx9NUFkQx753uWuCyyxp
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3212eb39245116d7bea52a73678c80b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3212eb39245116d7bea52a73678c80b0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD586a69d75be65c539583d92746971a3eb
SHA1950ff517ac728a5b12000367a503bf017ddd99b7
SHA256f7a54925b0c14db3bead53d904b964250d40844eaa9edfba824f2657a2fb6554
SHA51200b9686bf5fdd15d10ff2ad4e6af619ee6dd144e1d14e47a6072752610b461b0a0210e49bb4310c6ae2a277fa3b4d98c9eb403c8ee93f1f04678ea0c0b0a7722
-
Filesize
2.5MB
MD5428d0eff5378ba68d3476e55d2907f29
SHA1fca63c28ec1614d6b2303d32c12c2a38a1861635
SHA256e8247ee5f039e91ae19f7ed6a6ba9dac1815ae90f35d33b6232027fc52f07b09
SHA5125a29a2a91d31cde1a3b1dbdcc5207aaa364a0293118b066d29df191fbc3dc9597762f8515863e6b935e7b0702c3cbb7c0491e09ef3e4a59ffed647360203407a
-
Filesize
2.5MB
MD5b57429a7ead9b13c2bc531ab737e26b3
SHA1e4b6155fae4d35e3d7a73141196fb59ae8a0cff5
SHA2568623d02000d94c5f7447b101d6f9365da0131faa33c1891987899a3e546d1198
SHA512519ac423a5fed15d0f95777c61a2fd2fa9ef34f2f0bf65fe19691f8a49390dd8d369cfd3aba15d4fa809b164a66918d605c4ff528bcfb9cc1c686070e6b12270
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB