Analysis

  • max time kernel
    127s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 08:28

General

  • Target

    dfa42edcacf62525e9d402e0ea5dceb0_NeikiAnalytics.exe

  • Size

    256KB

  • MD5

    dfa42edcacf62525e9d402e0ea5dceb0

  • SHA1

    23ff3d211ddd602abc153db255fd9a31367a24bb

  • SHA256

    de2a63770755c84768f8420a14f3af760fd77c026770abdbad7989aca16914c7

  • SHA512

    b7c3232192ce0bb6c8de8510e08ff12c09c3421ed1317ff1c19e3be4b7ea2cf7d49591ef18dd0a23a09d878a95c01ea16b3f1ba439563d973c9de95f71198767

  • SSDEEP

    6144:0DLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:UQCyQ1LHk+zR7QHjGo

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfa42edcacf62525e9d402e0ea5dceb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\dfa42edcacf62525e9d402e0ea5dceb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Modifies Installed Components in the registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2736
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat
      2⤵
      • Deletes itself
      PID:2920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:2108

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\yyyy

      Filesize

      256KB

      MD5

      1dca55d584ef12f91d331597f44babc0

      SHA1

      5ddc6bf8a8032a7a731a3d97d0948dd463fa95ad

      SHA256

      7d2287fe634810e7db8940e1419d2dedef63dab5b5615be63efb32a0d589a5cb

      SHA512

      33102c225c8be496f8ac403771bb2e54d9d0c1ccb2c49073a10a5314aec3620b5b43ff4979043c2d4bc58c879ea569164e9a95182e12f881eef8bbd4585a18c1

    • C:\Users\Admin\AppData\Local\Temp\yyyy.bat

      Filesize

      337B

      MD5

      a227b8cb6c2cd1db1dbf57d656327afd

      SHA1

      30ccad6a1473afef036421ed6138f385131f5ffa

      SHA256

      23862081c241b2989be01cb445521f4d6a3389308c3f90a9ecf8597e0e66b062

      SHA512

      242df788005e263933306386e1b5af010223737e2b45d52dfc91422344884ddeee1a1dad475b7a1b9d285d1d191ac86b9ebf40951011230f9ea041711a713ef1

    • C:\Windows\System32\drivers\etc\hosts

      Filesize

      2KB

      MD5

      a1d921556cf3a3d9d26b2ef002a7f87e

      SHA1

      6d35761aa3c8d24ab25db1d6a6e8a964bebd7121

      SHA256

      be7dfb47e11615f6b0cda24d8d568fccb6cea492112f723b8784ee26cbe5d309

      SHA512

      282607c9fc123c57dff829e728c4b08fe7fa27a130903907856127c9aec7d7f2c83c8e6d812208291c495cf25af195404d9010391cf53fcd12f2647475acc049

    • memory/1312-1-0x0000000000400000-0x000000000048C000-memory.dmp

      Filesize

      560KB

    • memory/1312-0-0x0000000000400000-0x000000000048C000-memory.dmp

      Filesize

      560KB

    • memory/1312-19-0x0000000000400000-0x000000000048C000-memory.dmp

      Filesize

      560KB

    • memory/2736-24-0x0000000004F10000-0x0000000004F20000-memory.dmp

      Filesize

      64KB