Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:16
Behavioral task
behavioral1
Sample
552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe
-
Size
576KB
-
MD5
552ea2b814e9b288e0ac30e421b0e990
-
SHA1
05af8bb22349b84805603650532cd28e319f49a2
-
SHA256
1c16388e56c0498c94f30b66f2709691f206d7cbb25420eda7005e9a2b43a844
-
SHA512
5891f0746ef92f87ba517b4fcd7a353e4610ab211b02d20df84921551adf5d9574053cc6d93a28a23dec36b9a18085eeb08090edf1a0b2eca1773bb1a55b62ac
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoS6:+NWPkHlUfBgpuPdWzyuDTifgyWlt
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 4108 mcsft.exe 2352 mcsft.exe -
Processes:
resource yara_rule behavioral2/memory/1532-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx C:\Users\Admin\AppData\Roaming\mcsft.txt upx behavioral2/memory/1532-29-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/2352-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4108-36-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/2352-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2352-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 4108 set thread context of 2352 4108 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 2352 mcsft.exe Token: SeSecurityPrivilege 2352 mcsft.exe Token: SeTakeOwnershipPrivilege 2352 mcsft.exe Token: SeLoadDriverPrivilege 2352 mcsft.exe Token: SeSystemProfilePrivilege 2352 mcsft.exe Token: SeSystemtimePrivilege 2352 mcsft.exe Token: SeProfSingleProcessPrivilege 2352 mcsft.exe Token: SeIncBasePriorityPrivilege 2352 mcsft.exe Token: SeCreatePagefilePrivilege 2352 mcsft.exe Token: SeBackupPrivilege 2352 mcsft.exe Token: SeRestorePrivilege 2352 mcsft.exe Token: SeShutdownPrivilege 2352 mcsft.exe Token: SeDebugPrivilege 2352 mcsft.exe Token: SeSystemEnvironmentPrivilege 2352 mcsft.exe Token: SeChangeNotifyPrivilege 2352 mcsft.exe Token: SeRemoteShutdownPrivilege 2352 mcsft.exe Token: SeUndockPrivilege 2352 mcsft.exe Token: SeManageVolumePrivilege 2352 mcsft.exe Token: SeImpersonatePrivilege 2352 mcsft.exe Token: SeCreateGlobalPrivilege 2352 mcsft.exe Token: 33 2352 mcsft.exe Token: 34 2352 mcsft.exe Token: 35 2352 mcsft.exe Token: 36 2352 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exemcsft.exemcsft.exepid process 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe 4108 mcsft.exe 2352 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.execmd.exemcsft.exedescription pid process target process PID 1532 wrote to memory of 4556 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe cmd.exe PID 1532 wrote to memory of 4556 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe cmd.exe PID 1532 wrote to memory of 4556 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe cmd.exe PID 4556 wrote to memory of 3224 4556 cmd.exe reg.exe PID 4556 wrote to memory of 3224 4556 cmd.exe reg.exe PID 4556 wrote to memory of 3224 4556 cmd.exe reg.exe PID 1532 wrote to memory of 4108 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe mcsft.exe PID 1532 wrote to memory of 4108 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe mcsft.exe PID 1532 wrote to memory of 4108 1532 552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe PID 4108 wrote to memory of 2352 4108 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\552ea2b814e9b288e0ac30e421b0e990_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZTSNe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZTSNe.txtFilesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
C:\Users\Admin\AppData\Roaming\mcsft.txtFilesize
576KB
MD59db5c4bd2246106d6014143e13ed31bc
SHA1c59084052131de704caa51a98ea7a760608b7e53
SHA256b4f47a99f5f157f5bd80eadfd6ab613230c820b429292aac1dbfb6797c667a06
SHA5129c2e79d2b390449d5b048d47e38ebbeb214bf9389f138bca7e629876fab544f5ab2fbcf1f0b057a26e1b2c99846cbe3e55821f1d3a1873bd60e5b8957339aba9
-
memory/1532-0-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/1532-29-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB
-
memory/2352-43-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-46-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-35-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-37-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-41-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-40-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-39-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-38-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-42-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-32-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-44-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-45-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-34-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-47-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-48-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-49-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-50-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-51-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-52-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-53-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2352-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4108-36-0x0000000000400000-0x00000000007C8000-memory.dmpFilesize
3.8MB