Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 07:08
General
-
Target
53380073aa98e7bbbc09ef97cad9f6c0_NeikiAnalytics.exe
-
Size
3.6MB
-
MD5
53380073aa98e7bbbc09ef97cad9f6c0
-
SHA1
a7471cd91ba5f0a35c583c3a37d9537ab4b93d00
-
SHA256
1972669fc9b3fb869e568876786b6ca53727ca66a8e847945025927c1ec8a21e
-
SHA512
d22f4ebf79153c9ed0a55b9f58d7ae929abe6bdf6b5b933b734151e79db2c0aa7966e6de1f7ba06a3c25f3315f311c10519c35b8c8a196a3d93cb5dbd7c6e093
-
SSDEEP
49152:dsgY1bXNn4iM1mo7JFAU9YfLxd4cY1DJmXTHX1bLu1LriJzf64iVDJEh:+gwrNn4Yo7Lefb4cY1DY5bL4Lrc7NaJS
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 15 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53380073aa98e7bbbc09ef97cad9f6c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\53380073aa98e7bbbc09ef97cad9f6c0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD554fd8ae71831d9afc54c3b3a9cad01e8
SHA1c8cd04c1fd27990aaaf98c16d28d9fddaa61beb5
SHA256143ac77670384287b780c744a95ce45e95b28747cdc93a75069be8ffb8da2962
SHA512de6fb3af41c9b3831625935c29998f106bd9361edb13a1b9ce02f5295298b17771e9bf01dec7ca749ff00b517de9e6ea77935185c1081a1795cbf0e69af17f40
-
Filesize
3.6MB
MD5eb3e4e6b46514597797ae002336092f1
SHA11147dd9f8a688cb476036006fc8e37059635c6b8
SHA256e205e9a9a50e3968823c2c937e6c67b933cd142ed12c77039325913efdd0c66b
SHA512d6fb8e724cca088071c775626f942acc86e3f5c07ec4316074cc4b053b458103f634c1219de2e709c247b088140f8777f83a015db18301f313017ed2f9ab4ce7
-
Filesize
3.6MB
MD5bf1652fb65cae0f7b3fac0ffa74e9659
SHA1118743639748c7e50c3b9268b063a01ed9e248d9
SHA256212ea8151c8a6d0f5eea6ca7cdfffd132766fa194e7597e361d8dc4c65619ad4
SHA5126d425c53c4992aa4998865d7874aa6854ec6161c7fc6f33510df247e3f5dd9bde1850849b3c8555f925da23f76d4448ca1442934635ce04a2c73d7e308cd71ca
-
Filesize
3.6MB
MD54a91bc0dfd39beca8b101deaf1f2071d
SHA134ed107d2607cf069076fc5038cea5f8313ff2fb
SHA2565dcb1c637ed672773e73946d8a74d6ea690a35471bd34b0794b3cc54f9e7cca5
SHA512be5587961a8be71e2f4f2940a7326ed255fe9f205096540395c17822222fa7ef000523cbf9d4b0e2ca3230402267b2d14ccc5c78b2e90d7ba981aea630b30d3c
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8KB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB