Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 15:07
Behavioral task
behavioral1
Sample
e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe
-
Size
240KB
-
MD5
e27b28d9b047458a493ffda01bebeef0
-
SHA1
0227d56645601ab2ac1b3f94d90164c8346ced5e
-
SHA256
3f3c8a2b9d1298a72c337887bfe68d66aeecdb9c3ca72dc7f9550f702c31f03f
-
SHA512
f8b8f35269b25f7f95dea3f030b242762f83ab82bf364ca9c4f80e9b61a1c642704e242b1ffd8c51fd00d6d879455fd9546838db125c79e2e011f15c238b791e
-
SSDEEP
6144:VBoXYv1rTTdFB4Tbk2V27e+fbhJAPNADR:XD1rT5vV2W
Malware Config
Signatures
-
Blocklisted process makes network request 9 IoCs
flow pid Process 2 1252 rundll32.exe 4 1252 rundll32.exe 6 1252 rundll32.exe 12 1252 rundll32.exe 13 1252 rundll32.exe 14 1252 rundll32.exe 15 1252 rundll32.exe 16 1252 rundll32.exe 17 1252 rundll32.exe -
resource yara_rule behavioral1/files/0x000a000000012280-4.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 2604 ettmtcigc.exe -
Executes dropped EXE 2 IoCs
pid Process 2604 ettmtcigc.exe 1240 wiseman.exe -
Loads dropped DLL 4 IoCs
pid Process 1252 rundll32.exe 1252 rundll32.exe 1252 rundll32.exe 1252 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wiseman = "C:\\wiseman.exe" wiseman.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\skkmkldhn\\rvkmwvg.dll\",GetWindowClass" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\z: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2080 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1252 rundll32.exe 1252 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1252 rundll32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2116 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 2604 ettmtcigc.exe 1240 wiseman.exe 1240 wiseman.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1932 2116 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 1932 2116 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 1932 2116 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 1932 2116 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 28 PID 1932 wrote to memory of 2080 1932 cmd.exe 30 PID 1932 wrote to memory of 2080 1932 cmd.exe 30 PID 1932 wrote to memory of 2080 1932 cmd.exe 30 PID 1932 wrote to memory of 2080 1932 cmd.exe 30 PID 1932 wrote to memory of 2604 1932 cmd.exe 31 PID 1932 wrote to memory of 2604 1932 cmd.exe 31 PID 1932 wrote to memory of 2604 1932 cmd.exe 31 PID 1932 wrote to memory of 2604 1932 cmd.exe 31 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 2604 wrote to memory of 1252 2604 ettmtcigc.exe 32 PID 1252 wrote to memory of 1240 1252 rundll32.exe 33 PID 1252 wrote to memory of 1240 1252 rundll32.exe 33 PID 1252 wrote to memory of 1240 1252 rundll32.exe 33 PID 1252 wrote to memory of 1240 1252 rundll32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&c:\ettmtcigc.exe "C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2080
-
-
\??\c:\ettmtcigc.exec:\ettmtcigc.exe "C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\skkmkldhn\rvkmwvg.dll",GetWindowClass c:\ettmtcigc.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\wiseman.exe"C:\wiseman.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1240
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD58f242369cf14f2b26ced131d7dd67144
SHA1d4f2f0f3047300ff5f36af6119ad5e109258fcd0
SHA25603505198d487e04a8ec82c627d34e4d9145f211140c4c8793b4461621e6bf6ce
SHA5124516b3fa2f68e64baf166bc7731ba3bb0ca53d36d71ff8fa78b1f211d7c14fc4442af50bd637d0c3f11913583c9c66996101d6e8738592a053e82a78bbd771f5
-
Filesize
240KB
MD566591434e28048deeedf744275975fe3
SHA1a581c2ec69bcd8c2c5c2fb14864ca8e077190b5d
SHA256ce9d4c803e65310070648f9505f98704e031d71a65970259a3d0912535faa3cc
SHA512063b38d90f6636199fb1e8f666487109abb6cf1ac47e7bb87927911ed2842e76d61fde5bf60a8be106f4a5b436857d00612daf6ee3180d3d07e576d158172959
-
Filesize
71KB
MD510eb9b069e53509dfe5652372437858d
SHA1f5b7b4d4f4afe9439d78f43c1915cb3bd07fc620
SHA256c8c3ce80cc170f0a7a3a1ca9120e8279a3f323604b50478ad81869c4131f6315
SHA5126105b5547aa7754183471d395de4fabda8780b5000db2dc4d799bf3af27fca546a0548e6dcc4f435bee5f39e291cae400d7b8efd0d1d7034d31c4e92891b4051