1eaa4cd7a442e8473c47a67120920af751c1cbbe7e63543c1f5d206c5bbacbfa

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Size

4.1MB
MD5

503efa0bf90c646caf5dc14ac3583b30
SHA1

0d82ae4b15978167e4ce606cd4ee7b132caaa3fb
SHA256

1eaa4cd7a442e8473c47a67120920af751c1cbbe7e63543c1f5d206c5bbacbfa
SHA512

2c9288aa459a62388014097919d88e7a7691d9044aa509a1978db24a3a4c8e5b765124ad193d0ce8eac48d8a1e98b29ea27cc0fdc893500d572d8c86b8b3f89d
SSDEEP

98304:sqqTewvfzKDYxb2GA5Ir4Uu8j13PDmZ3uakQrBDhB:STlKIbBCe39mZ3uMrBDr

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

description ioc process

File opened for modification \??\PhysicalDrive0 503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

Modifies registry class 11 IoCs

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "2d1cd219f4ea00e611777774b909b11d"	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "E7D7DCD0EDFCBE1CD0672829546F1F89"	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

pid	process
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

pid	process
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2156	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-30-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download