Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe
-
Size
86KB
-
MD5
cc9f609742cf713f33b62b4671c46ad0
-
SHA1
a673ca4ad193e51f602fa06e63a4489bb088d867
-
SHA256
276d8a997289099d704a5ce94f749e743fd1cc94d8757230378156a7e1119d42
-
SHA512
1d9c9de4ec9794dc52bb31d3786225affa8b39bbc537a4f4d6ffa97e18d529e0a7cc9d627dee658af4083e866eb401f0b3165c70f3347bddfccdf7c84e23af6d
-
SSDEEP
1536:1MIPgEm56wnbkKC2ZyBJU066lwLCRVEB+nR/y8cmNrEIviCOzuajkrDl9HNS7:11PgEOng1d66jRVa+n4NmNNouukrD7Hw
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
flow pid Process 24 1964 rundll32.exe 49 1964 rundll32.exe 50 1964 rundll32.exe 51 1964 rundll32.exe 55 1964 rundll32.exe 59 1964 rundll32.exe 68 1964 rundll32.exe 74 1964 rundll32.exe -
Deletes itself 1 IoCs
pid Process 220 rmvjo.exe -
Executes dropped EXE 1 IoCs
pid Process 220 rmvjo.exe -
Loads dropped DLL 1 IoCs
pid Process 1964 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0008000000023258-9.dat upx behavioral2/memory/1964-11-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral2/memory/1964-12-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral2/memory/1964-16-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral2/memory/1964-17-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral2/memory/1964-18-0x0000000010000000-0x0000000010022000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\dwrboxr\\hgwhu.ghh\",crc32" rundll32.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\b: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Kills process with taskkill 1 IoCs
pid Process 2432 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3348 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1964 rundll32.exe 1964 rundll32.exe 1964 rundll32.exe 1964 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1964 rundll32.exe Token: SeDebugPrivilege 2432 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4900 cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe 220 rmvjo.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4900 wrote to memory of 2404 4900 cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe 90 PID 4900 wrote to memory of 2404 4900 cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe 90 PID 4900 wrote to memory of 2404 4900 cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe 90 PID 2404 wrote to memory of 3348 2404 cmd.exe 92 PID 2404 wrote to memory of 3348 2404 cmd.exe 92 PID 2404 wrote to memory of 3348 2404 cmd.exe 92 PID 2404 wrote to memory of 220 2404 cmd.exe 93 PID 2404 wrote to memory of 220 2404 cmd.exe 93 PID 2404 wrote to memory of 220 2404 cmd.exe 93 PID 220 wrote to memory of 1964 220 rmvjo.exe 94 PID 220 wrote to memory of 1964 220 rmvjo.exe 94 PID 220 wrote to memory of 1964 220 rmvjo.exe 94 PID 1964 wrote to memory of 2432 1964 rundll32.exe 95 PID 1964 wrote to memory of 2432 1964 rundll32.exe 95 PID 1964 wrote to memory of 2432 1964 rundll32.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\rmvjo.exe "C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\rmvjo.exeC:\Users\Admin\AppData\Local\Temp\\rmvjo.exe "C:\Users\Admin\AppData\Local\Temp\cc9f609742cf713f33b62b4671c46ad0_NeikiAnalytics.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\dwrboxr\hgwhu.ghh",crc32 C:\Users\Admin\AppData\Local\Temp\rmvjo.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\windows\SysWOW64\taskkill.exetaskkill /f /im attrib.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:2300
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5a5742092445feb833c2ef762189cd0b0
SHA1ef3edae57d98a0902611366e0da8e1fb3b5fb25a
SHA256a3589c7419e3e1d32ec3489943541b0328ba6bb73a14b16a1d0d92fdbf14f3f2
SHA512cbf2a2bb6d70ef8ce8229c9c2a754ab4b8df5b95d6c33be4f40b88e45403720addc556ce3f06824c85be68ab85bf0d4ae7d85bdf467b972dc5f1d988bd878e12
-
Filesize
57KB
MD52f53f49e01f09d6e6064871eec1955cd
SHA1a6e1a6e5c2080d0fb2f7a872e3902a8a4a1a9b5f
SHA256964e4dd2532d540bb61d3c7ccc833f2358d8cd6b2eabc3a2d51183a18b59f82d
SHA5122cb98030c3df7417c04f796f78f23f96d381871d9c7ae4a14116764e915b2e2f56b9b3a6fb76fedc50a17788de9538fc7954a7b73bf17e4be43e1fc1a06bc218