Analysis

  • max time kernel
    142s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 11:14

General

  • Target

    cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe

  • Size

    1.2MB

  • MD5

    cf3e09bef6f2edc09d019ae7ae23ca60

  • SHA1

    1a14b7d2639dd79c9e994d0b0b50154533051cf9

  • SHA256

    283cdf597f0f1956b187870443ba3354efea512d72a52f56c535c61334c21b6a

  • SHA512

    841f18b0f9157f580a5eef4224d5d9350300b8d1f9d45f9c5583065fe3ade296b8895e38a046d37ca5d3f898c96b2a948a0ca8d9a8f5bf989e412579a1a4c596

  • SSDEEP

    24576:vsX2vzpbZGaKBVlEn+f3VgikCFkJ9k4i/izgNwMqfQN+Qfsqr:EGvz7GfY+f3VOCiJS46iwwMqqB0qr

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cf3e09bef6f2edc09d019ae7ae23ca60_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe
      "C:\Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe" "u 'http://www.freeridegames.com/spdo/feeds/sdmConfig?camp=%s&serviceId=143&gameId=%d' p '143' c '585550' m 'seoDD' t '0' l 'Default'"
      2⤵
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPR
        3⤵
        • Executes dropped EXE
        PID:2960
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPW
        3⤵
        • Executes dropped EXE
        PID:2812
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPW
        3⤵
        • Executes dropped EXE
        PID:908
      • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
        UPW
        3⤵
        • Executes dropped EXE
        PID:788
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PR
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      R
      2⤵
      • Executes dropped EXE
      PID:2760
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:1752
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:2616
  • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
    "C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe" PW
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe
      W
      2⤵
      • Executes dropped EXE
      PID:2440

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

          Filesize

          23B

          MD5

          4174cb800274e3c271f7e53ae1b9ae35

          SHA1

          6ac0ca77eef3b68c8db3349f1ceb0c8083450642

          SHA256

          d5e0a12b015868fdafdbdcef807fee6bf17e326db04c64079833e829bf34112e

          SHA512

          c73823299a4706ad1feec4497c1e01c598beebe5679a1bbae2cfa6305b282f719c5c14c1fbc3d982db111cda6cdcc7721f22880391155ae9112f6b5f1cdb7cdd

        • C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

          Filesize

          115B

          MD5

          cfa86d99a63e54128204fbb4a3c036cf

          SHA1

          b7ed81965e78e5383aa7ae73c0a6130a5658af38

          SHA256

          52d4d76788999a904252d8049a335c7e78b789f6ec639fc57d9242c69012db98

          SHA512

          6fe2576626b5336d90b9a2f10e85e2df4a23f2cd6683f5ed2d51e4735880eac0af91fa3e92bea2f944aed145e74e9372e3dcbebf2974bbb038102557491c38cc

        • C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

          Filesize

          232B

          MD5

          9b793375c56020539f12ee1f1793b480

          SHA1

          12c73c14d0eb5df529b5d157d6073529fb8dc2e6

          SHA256

          b5372f6dfb0bacdad7c0c9dfdc53f1224b5c01accabc374ad141c5402d21aba8

          SHA512

          496eec1aa1b4009ed595ca1752e5382ba3312a77617de101c5338843a101a38d82df8742780852ec200aa4e9e7f1ed9a239f2aab8d6960b466728e9a9162205a

        • C:\Users\Admin\AppData\LocalLow\Temp\ietemp1.dat

          Filesize

          347B

          MD5

          c4aa297f6d02e0da61a7e4201f557a7f

          SHA1

          7f34db9aec9af5554aa84de354b5b42a918ce80d

          SHA256

          db75832984370a33ca7dbe580f57f9cc65f34d45b4e75f608564410644eafaae

          SHA512

          3252f8ac8421416bc4d33b71c087fc43c0256e2d7856783fdb74427d76bf6bfae340b7e19ee47d577faa221cb3d2009a7822e6545b5e7912db72027778dfcf69

        • C:\Users\Admin\AppData\Local\Temp\SDM143\cmhelper.exe

          Filesize

          234KB

          MD5

          51d301714c7361192d6305f6c46d90d1

          SHA1

          f546aac6dfab1187228df393e0db2c21e4fee1d0

          SHA256

          c9245047b86f8359a7f313434b85af481008e8cdf9579fd55aff8b8fbfb5ebcb

          SHA512

          9b6149c9c099f9cea3d574723d9ff6678d4f91ae7408349738a999d4986ce3cb7b4886f2972f6f1d3b27f7f7453a764f05c50d383f7054234b4ae55437d369b6

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I131J5SI.txt

          Filesize

          320B

          MD5

          bb5cbfae59df24dd68f287e4b1578b4a

          SHA1

          41249166e72b98c987df868f3a4c28fb64ef25a0

          SHA256

          ea35ade3193938f8da18a6e7b8963115d534f4fa4010869f0dc4819061203b8c

          SHA512

          dde49626ac89d8119460524a65d8487a207eb5243650439f745fb745672179ce802f7340123e60a0230a5670ce3b80c1246d4ec525f55623a36253e755076525

        • \Users\Admin\AppData\Local\Temp\SDM143\Free Ride Games.exe

          Filesize

          519KB

          MD5

          2db35d715864b8846f21dc95756171e0

          SHA1

          ed9030449256bd21e4f041961fb27bbbeddd7fff

          SHA256

          854bb62475a4b700a7ec49651610d050f1651491d0148c4bd4928b18bdc0436b

          SHA512

          65b62a0450a60f736af6ac42d6bec252160feac0681cc6319cbd32e76d631a4ea6d206dd62cee5cc00dd22e3de8dbf042024caa22d4288f8b932276f7b93898f

        • \Users\Admin\AppData\Local\Temp\SDM143\Splasher.dll

          Filesize

          475KB

          MD5

          41d94c8eb8cb17e04f8ec6e14132f9ca

          SHA1

          add92b031eb36b26335763780df88bca58636ed7

          SHA256

          2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96

          SHA512

          0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7

        • \Users\Admin\AppData\Local\Temp\SDM143\resourceDll.dll

          Filesize

          171KB

          MD5

          5cf0fba9e8775382233c8e63e52c838a

          SHA1

          b2a092f71eff0f6916652d7f3bfde9204eda5636

          SHA256

          7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5

          SHA512

          73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25

        • \Users\Admin\AppData\Local\Temp\nsi164F.tmp\System.dll

          Filesize

          11KB

          MD5

          a436db0c473a087eb61ff5c53c34ba27

          SHA1

          65ea67e424e75f5065132b539c8b2eda88aa0506

          SHA256

          75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

          SHA512

          908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

        • memory/788-97-0x00000000001D0000-0x00000000001D2000-memory.dmp

          Filesize

          8KB

        • memory/908-86-0x00000000008E0000-0x00000000008E2000-memory.dmp

          Filesize

          8KB

        • memory/2072-44-0x0000000003580000-0x00000000036E4000-memory.dmp

          Filesize

          1.4MB

        • memory/2072-155-0x0000000003580000-0x00000000036E4000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-53-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

        • memory/2672-163-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-181-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-51-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

        • memory/2672-48-0x0000000010000000-0x000000001009F000-memory.dmp

          Filesize

          636KB

        • memory/2672-153-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-45-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-156-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-157-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-159-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-161-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-179-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-165-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-167-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-169-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-171-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-173-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-175-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2672-177-0x0000000000400000-0x0000000000564000-memory.dmp

          Filesize

          1.4MB

        • memory/2812-75-0x0000000000280000-0x0000000000282000-memory.dmp

          Filesize

          8KB

        • memory/2960-65-0x00000000003D0000-0x00000000003D2000-memory.dmp

          Filesize

          8KB