Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 10:32

General

  • Target

    c751a92f994f48bd649ba49dd93d5930_NeikiAnalytics.exe

  • Size

    1.8MB

  • MD5

    c751a92f994f48bd649ba49dd93d5930

  • SHA1

    44b7e2fa7f120f130e57620ae0c44399574d7272

  • SHA256

    e21b8e3512ade3cd3cc8fdd64f0a8c611511b1d1bdde9da2f0bc54f0f1aa338b

  • SHA512

    dba3e7c36d5a29ac4d2cc3401f31e6e0a7787608ce83d3826b0837c99502d7a830bce552bc2936a648983e0e01aa7264afaa4e7aa17cd879cc574787880b5243

  • SSDEEP

    49152:c4AVlITwNJekqw0YqJ5tdrhEpFDZkJP19lH40+MO:9AlgNkqw0YqJ5vGvNiPFHr8

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://5.42.96.141

http://5.42.96.7

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain
rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c751a92f994f48bd649ba49dd93d5930_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c751a92f994f48bd649ba49dd93d5930_NeikiAnalytics.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:4872
        • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3096
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:4480
        • C:\Users\Admin\1000006002\ab729071bc.exe
          "C:\Users\Admin\1000006002\ab729071bc.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          PID:3416
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:5012
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:692
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:920
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3084
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3924
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4252

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\1000006002\ab729071bc.exe

      Filesize

      2.1MB

      MD5

      29ae760d21e9a54c50daaf021b7e2ffc

      SHA1

      1114b6e97e0da531fd763aaf46146908f8a067a9

      SHA256

      8a77b3b86e0da5f55e682ea9871014ec07ee7813a88a26f74dd0747675959d55

      SHA512

      f5ac0e28451d9b81eb7b891d4e9555104d418b8f68cddf82fa210e6a642339a6e6f1c795257c219dd01d225420c37962813931a27d3049e4fea2430867f9ca50

    • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

      Filesize

      1.8MB

      MD5

      76b3df90091f71476b4f7dbbe57aabad

      SHA1

      b8d504ed9a2bc2b88a7561df8359977054c2432f

      SHA256

      9b0acd138f37415b01b9c5bba267c2fbe893fff81d109f886a1cf4edb8443220

      SHA512

      dd6071855345d17df57cafb75dd54363fc5da4f84e0a71920db3eb10c4dcc1a484d8dcfe1541f127afefd3167dfa22e078dfbb4f07cb4989338eb0ac2c8ee5d8

    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

      Filesize

      1.8MB

      MD5

      c751a92f994f48bd649ba49dd93d5930

      SHA1

      44b7e2fa7f120f130e57620ae0c44399574d7272

      SHA256

      e21b8e3512ade3cd3cc8fdd64f0a8c611511b1d1bdde9da2f0bc54f0f1aa338b

      SHA512

      dba3e7c36d5a29ac4d2cc3401f31e6e0a7787608ce83d3826b0837c99502d7a830bce552bc2936a648983e0e01aa7264afaa4e7aa17cd879cc574787880b5243

    • memory/692-86-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/692-57-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/920-114-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/920-112-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3084-113-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/3084-111-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/3096-53-0x00000000006B0000-0x0000000000B5C000-memory.dmp

      Filesize

      4.7MB

    • memory/3096-39-0x00000000006B0000-0x0000000000B5C000-memory.dmp

      Filesize

      4.7MB

    • memory/3416-84-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-80-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-82-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-85-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-81-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-83-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-79-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-93-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-77-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3416-78-0x0000000000C80000-0x00000000012F6000-memory.dmp

      Filesize

      6.5MB

    • memory/3500-91-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-125-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-56-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-141-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-21-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-20-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-19-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-116-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-18-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-88-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-89-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-90-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-119-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-134-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-104-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-94-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-122-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-128-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-98-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-109-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3500-101-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3924-135-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/3924-139-0x00000000003C0000-0x000000000087F000-memory.dmp

      Filesize

      4.7MB

    • memory/4252-136-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4252-138-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4360-0-0x0000000000660000-0x0000000000B1F000-memory.dmp

      Filesize

      4.7MB

    • memory/4360-3-0x0000000000660000-0x0000000000B1F000-memory.dmp

      Filesize

      4.7MB

    • memory/4360-5-0x0000000000660000-0x0000000000B1F000-memory.dmp

      Filesize

      4.7MB

    • memory/4360-2-0x0000000000661000-0x000000000068F000-memory.dmp

      Filesize

      184KB

    • memory/4360-1-0x0000000077E34000-0x0000000077E36000-memory.dmp

      Filesize

      8KB

    • memory/4360-17-0x0000000000660000-0x0000000000B1F000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-99-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-131-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-120-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-102-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-123-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-117-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-126-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-96-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-129-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-105-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-95-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-110-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-92-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-142-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/4480-51-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/5012-87-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB

    • memory/5012-58-0x0000000000360000-0x000000000080C000-memory.dmp

      Filesize

      4.7MB