Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe
-
Size
115KB
-
MD5
a2effe1b2d4511ab6244b91426b46140
-
SHA1
591367e87725c9bf432e319f40a7a2db7cb0b0f4
-
SHA256
c4aa31bf9e7660a135b732aaac11ad863bc5a3d8c5866c5466746b763e2a868a
-
SHA512
7882c58f6d3256acce1b69b66318b438a4199d725236a392ddab25d040925012a3600f4e57a8eba10413a3f3bff7fcb553f069c31b36fcf375a808549ec641c1
-
SSDEEP
3072:EagwS1Ut+KNPJI1F3Md55keTZwcM2I38QXy:vUGPJKF3Md55ZTZwz38QX
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 4 2580 rundll32.exe 6 2580 rundll32.exe 7 2580 rundll32.exe 8 2580 rundll32.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0010000000015c5d-13.dat acprotect -
Deletes itself 1 IoCs
pid Process 3064 oiqrr.exe -
Executes dropped EXE 1 IoCs
pid Process 3064 oiqrr.exe -
Loads dropped DLL 3 IoCs
pid Process 3024 cmd.exe 3024 cmd.exe 2580 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\tmptb\\euowj.uwe\",LoadXML" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\e: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Kills process with taskkill 1 IoCs
pid Process 2532 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2844 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2580 rundll32.exe Token: SeDebugPrivilege 2532 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe 3064 oiqrr.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3024 2872 a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe 28 PID 2872 wrote to memory of 3024 2872 a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe 28 PID 2872 wrote to memory of 3024 2872 a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe 28 PID 2872 wrote to memory of 3024 2872 a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2844 3024 cmd.exe 30 PID 3024 wrote to memory of 2844 3024 cmd.exe 30 PID 3024 wrote to memory of 2844 3024 cmd.exe 30 PID 3024 wrote to memory of 2844 3024 cmd.exe 30 PID 3024 wrote to memory of 3064 3024 cmd.exe 31 PID 3024 wrote to memory of 3064 3024 cmd.exe 31 PID 3024 wrote to memory of 3064 3024 cmd.exe 31 PID 3024 wrote to memory of 3064 3024 cmd.exe 31 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 3064 wrote to memory of 2580 3064 oiqrr.exe 32 PID 2580 wrote to memory of 2532 2580 rundll32.exe 33 PID 2580 wrote to memory of 2532 2580 rundll32.exe 33 PID 2580 wrote to memory of 2532 2580 rundll32.exe 33 PID 2580 wrote to memory of 2532 2580 rundll32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\oiqrr.exe "C:\Users\Admin\AppData\Local\Temp\a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\oiqrr.exeC:\Users\Admin\AppData\Local\Temp\\oiqrr.exe "C:\Users\Admin\AppData\Local\Temp\a2effe1b2d4511ab6244b91426b46140_NeikiAnalytics.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\tmptb\euowj.uwe",LoadXML C:\Users\Admin\AppData\Local\Temp\oiqrr.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\windows\SysWOW64\taskkill.exetaskkill /f /im attrib.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5230bd5cd04a5f8ea04af339783d1bf58
SHA1803b2400b5e2146853dca3908e58f96bd554f1e0
SHA2567590edd94bd18449a3432a0054cf3e6ed53f8bd01202e1706f82f83056c0f029
SHA5129500742bc2798e94e78ae24736b51c5294e4aecce5c1e3b77151fdf04fc7ac0da8eda8be5a6a9c5cc44308eb2ea6c40902f6b4ab1d0997ece103e83a97ab0729
-
Filesize
115KB
MD5cda88d6fbc2103b36c789d438b161a0b
SHA1da72c4d5cb0cb22969b5faead6168f95470ab703
SHA256215d01685acd96385c2df816e1eb735ee686df4c3e9263664a8482646be74829
SHA5123904368d8812bbc4ceb16727bebd39f665cf250fd11774b1f78bd47a9ecd11120d3e3399438711b12d0ce7b9d9596ff782163f9fe1782878b030f77a3b7e67cb