Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:00
Behavioral task
behavioral1
Sample
b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
b74e25bfe1ef2b74dea5d8955d654c20
-
SHA1
a32dc324923d256dbfbf7cfb222862d42f7248d2
-
SHA256
03b054227a8f087a0b939c8f88d9ab8c11ef6634db7167be7bb07d78808f1e57
-
SHA512
4b140ff1bb6aa3d484f321d9713889a1cdd5cd3cbe3b9b10acacb9bf98348a11dbe2b54f2023f6e5b3fd051e9b5bbcf6f72b7b1b2a2bb9434e601aceb0eb4043
-
SSDEEP
49152:LjA8ggSDcajICf3Ckh7lzBmwrqNGOHWG/gQtHyftAmYirEI5:Lc8h6Zh7Xmwr+HboQtSlAmYIX
Malware Config
Extracted
amadey
4.20
18befc
http://5.42.96.141
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
explorku.exeb74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorku.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorku.exeb74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorku.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe -
Executes dropped EXE 4 IoCs
Processes:
explorku.exeexplorku.exeexplorku.exeexplorku.exepid process 940 explorku.exe 4972 explorku.exe 3804 explorku.exe 4556 explorku.exe -
Processes:
resource yara_rule behavioral2/memory/3964-0-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-1-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-3-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-2-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-4-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-5-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-7-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-6-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/3964-8-0x0000000000950000-0x0000000000EA1000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe themida behavioral2/memory/3964-21-0x0000000000950000-0x0000000000EA1000-memory.dmp themida behavioral2/memory/940-22-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-23-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-26-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-30-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-29-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-28-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-27-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-24-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-25-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-32-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-33-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-36-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-35-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-34-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-38-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-39-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-37-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4972-41-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/940-42-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-49-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-51-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-54-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-53-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-52-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-50-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-55-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/3804-57-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-65-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-66-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-71-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-72-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-70-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-69-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-68-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-67-0x00000000007D0000-0x0000000000D21000-memory.dmp themida behavioral2/memory/4556-74-0x00000000007D0000-0x0000000000D21000-memory.dmp themida -
Processes:
explorku.exeb74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exeexplorku.exeexplorku.exeexplorku.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorku.exe -
Drops file in Windows directory 1 IoCs
Processes:
b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exedescription ioc process File created C:\Windows\Tasks\explorku.job b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exedescription pid process target process PID 3964 wrote to memory of 940 3964 b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe explorku.exe PID 3964 wrote to memory of 940 3964 b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe explorku.exe PID 3964 wrote to memory of 940 3964 b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe explorku.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b74e25bfe1ef2b74dea5d8955d654c20_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:940
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4972
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3804
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.7MB
MD5b74e25bfe1ef2b74dea5d8955d654c20
SHA1a32dc324923d256dbfbf7cfb222862d42f7248d2
SHA25603b054227a8f087a0b939c8f88d9ab8c11ef6634db7167be7bb07d78808f1e57
SHA5124b140ff1bb6aa3d484f321d9713889a1cdd5cd3cbe3b9b10acacb9bf98348a11dbe2b54f2023f6e5b3fd051e9b5bbcf6f72b7b1b2a2bb9434e601aceb0eb4043
-
memory/940-22-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-42-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-25-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-24-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-27-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-28-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-29-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-30-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-26-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/940-23-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-53-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-49-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-57-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-55-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-50-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-52-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-54-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3804-51-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/3964-2-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-1-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-8-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-6-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-7-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-21-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-5-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-0-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-4-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/3964-3-0x0000000000950000-0x0000000000EA1000-memory.dmpFilesize
5.3MB
-
memory/4556-69-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-66-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-65-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-71-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-72-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-70-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-68-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-67-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4556-74-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-32-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-41-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-37-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-39-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-38-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-34-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-35-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-36-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB
-
memory/4972-33-0x00000000007D0000-0x0000000000D21000-memory.dmpFilesize
5.3MB