Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 15:07
Behavioral task
behavioral1
Sample
e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe
-
Size
240KB
-
MD5
e27b28d9b047458a493ffda01bebeef0
-
SHA1
0227d56645601ab2ac1b3f94d90164c8346ced5e
-
SHA256
3f3c8a2b9d1298a72c337887bfe68d66aeecdb9c3ca72dc7f9550f702c31f03f
-
SHA512
f8b8f35269b25f7f95dea3f030b242762f83ab82bf364ca9c4f80e9b61a1c642704e242b1ffd8c51fd00d6d879455fd9546838db125c79e2e011f15c238b791e
-
SSDEEP
6144:VBoXYv1rTTdFB4Tbk2V27e+fbhJAPNADR:XD1rT5vV2W
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
flow pid Process 23 1760 rundll32.exe 24 1760 rundll32.exe 25 1760 rundll32.exe 36 1760 rundll32.exe 50 1760 rundll32.exe 58 1760 rundll32.exe 62 1760 rundll32.exe 74 1760 rundll32.exe -
resource yara_rule behavioral2/files/0x0008000000022f51-7.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation rundll32.exe -
Deletes itself 1 IoCs
pid Process 2396 ldydc.exe -
Executes dropped EXE 2 IoCs
pid Process 2396 ldydc.exe 692 wiseman.exe -
Loads dropped DLL 1 IoCs
pid Process 1760 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wiseman = "C:\\wiseman.exe" wiseman.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\phvbv\\hcthct.dll\",GetWindowClass" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\l: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3188 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1760 rundll32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 224 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 2396 ldydc.exe 692 wiseman.exe 692 wiseman.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 224 wrote to memory of 3144 224 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 83 PID 224 wrote to memory of 3144 224 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 83 PID 224 wrote to memory of 3144 224 e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe 83 PID 3144 wrote to memory of 3188 3144 cmd.exe 86 PID 3144 wrote to memory of 3188 3144 cmd.exe 86 PID 3144 wrote to memory of 3188 3144 cmd.exe 86 PID 3144 wrote to memory of 2396 3144 cmd.exe 89 PID 3144 wrote to memory of 2396 3144 cmd.exe 89 PID 3144 wrote to memory of 2396 3144 cmd.exe 89 PID 2396 wrote to memory of 1760 2396 ldydc.exe 90 PID 2396 wrote to memory of 1760 2396 ldydc.exe 90 PID 2396 wrote to memory of 1760 2396 ldydc.exe 90 PID 1760 wrote to memory of 692 1760 rundll32.exe 92 PID 1760 wrote to memory of 692 1760 rundll32.exe 92 PID 1760 wrote to memory of 692 1760 rundll32.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&c:\ldydc.exe "C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:3188
-
-
\??\c:\ldydc.exec:\ldydc.exe "C:\Users\Admin\AppData\Local\Temp\e27b28d9b047458a493ffda01bebeef0_NeikiAnalytics.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\phvbv\hcthct.dll",GetWindowClass c:\ldydc.exe4⤵
- Blocklisted process makes network request
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\wiseman.exe"C:\wiseman.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:692
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD58f242369cf14f2b26ced131d7dd67144
SHA1d4f2f0f3047300ff5f36af6119ad5e109258fcd0
SHA25603505198d487e04a8ec82c627d34e4d9145f211140c4c8793b4461621e6bf6ce
SHA5124516b3fa2f68e64baf166bc7731ba3bb0ca53d36d71ff8fa78b1f211d7c14fc4442af50bd637d0c3f11913583c9c66996101d6e8738592a053e82a78bbd771f5
-
Filesize
240KB
MD59409e622677c3427417264289a1caf19
SHA1f4b2faeb46078b15f13794b47ec33b6ebf8d599a
SHA25646e8af7be70a9387444b2a42b795866ffa6a08eb14d9b265cedfa6523417e83e
SHA512859b54f2330cd146a04611e90495cbcae0628fb5d26c53dc2a4e7fc099d81c545c10c50c709911f50fa2bfcafc1ea5ee9de3d8b587cbaa3140fcd20b3ecb3003
-
Filesize
71KB
MD510eb9b069e53509dfe5652372437858d
SHA1f5b7b4d4f4afe9439d78f43c1915cb3bd07fc620
SHA256c8c3ce80cc170f0a7a3a1ca9120e8279a3f323604b50478ad81869c4131f6315
SHA5126105b5547aa7754183471d395de4fabda8780b5000db2dc4d799bf3af27fca546a0548e6dcc4f435bee5f39e291cae400d7b8efd0d1d7034d31c4e92891b4051