Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19-05-2024 21:24
General
-
Target
3d7bdee34685dfb268370d035d40d670_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
3d7bdee34685dfb268370d035d40d670
-
SHA1
20cdf704b3f8638198d69cddb3f9ed4acea54cea
-
SHA256
25abfb39de1c7347b7518981194725c8cf00321ff98d22e544ba08add500b7c0
-
SHA512
bff9833be1fe334cfa23ce00cdf9b4028ca9b7bd63ba18c3cf59e8fcd506204333be34eaa3856fbcdb060ce4a35167452b4272712cb06ac07811dc9397daaeba
-
SSDEEP
49152:YxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxQ:Yxx9NUFkQx753uWuCyyxQ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d7bdee34685dfb268370d035d40d670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3d7bdee34685dfb268370d035d40d670_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5f269ee99f77b51f018a5ee240c487ada
SHA1b88b3be67fc051a19d401b211e668c349c8a1ca5
SHA256b7ebff4b57b709221a5f997f05c7b1a66cc0225dc3861fba6d5a50a80fdcf75c
SHA512dda2757b885232e3584824ddb1f8aa724da602538df8f419832e11412662bf08a906236756a61c310144209b29bb8963da4eacf452e48acd1d690483b351215b
-
Filesize
2.5MB
MD5ecf9606132936f3dabafea3947f57a0a
SHA1387c0e600f36de8fb469911d83c019addaa40b8d
SHA256ec6fb627190cd235545a60314eb40883921e2649e0e86c9381e1bfc0b33ebdfd
SHA512533138fce29480c3d8f8339464f83ba6e86e17e8bbc7864887b71b002f77519ee3aa46742612f8031e52147cb98964078236e68d155f461422825f88de2df1c6
-
Filesize
2.5MB
MD587e86dd3735edfbea4a77b0dc688a212
SHA19dab20d70ca5572f7d10d7f146781c1717b65f93
SHA2569e9843e8d01f8d4819a631a3bf764ec02a51b7ca0a3c8bc7e3ada376e14eb1bb
SHA512b26c1057a9b77719cacd31e2384e3774ee145e0078da6eeb74554e1c499cacf397fe8bfea7f3f3bdcc6e8adfb0d50111d0d81ed91cbdd8d4090234367aaa9099
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB