Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 19:18
Static task
static1
Behavioral task
behavioral1
Sample
040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe
-
Size
3.8MB
-
MD5
040fe7c98a63b2958d13431044461740
-
SHA1
ef2fbd6e8815cb8ec05b90ff5d53a58911824b9c
-
SHA256
6e3b1d888bc49f8f24bac05c00d40b0a6dc92c91b9390142334284021ae8d5b4
-
SHA512
e08116a523f2d9ea31a6a7d3f4259a0a34d294e84c21076430db092e1664082982cb038715ee86bac310d8f15e350f592173bbaaa4ed57e310da205dd93214d8
-
SSDEEP
98304:ki4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/q9:ki4hTLOMtHDMlANqnfVGPyhcMYg4lSi7
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
040fe7c98a63b2958d13431044461740_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
Processes:
mcsft.exemcsft.exepid process 3756 mcsft.exe 4636 mcsft.exe -
Processes:
resource yara_rule behavioral2/memory/4636-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4636-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mcsft.exedescription pid process target process PID 3756 set thread context of 4636 3756 mcsft.exe mcsft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mcsft.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
mcsft.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
mcsft.exedescription pid process Token: SeIncreaseQuotaPrivilege 4636 mcsft.exe Token: SeSecurityPrivilege 4636 mcsft.exe Token: SeTakeOwnershipPrivilege 4636 mcsft.exe Token: SeLoadDriverPrivilege 4636 mcsft.exe Token: SeSystemProfilePrivilege 4636 mcsft.exe Token: SeSystemtimePrivilege 4636 mcsft.exe Token: SeProfSingleProcessPrivilege 4636 mcsft.exe Token: SeIncBasePriorityPrivilege 4636 mcsft.exe Token: SeCreatePagefilePrivilege 4636 mcsft.exe Token: SeBackupPrivilege 4636 mcsft.exe Token: SeRestorePrivilege 4636 mcsft.exe Token: SeShutdownPrivilege 4636 mcsft.exe Token: SeDebugPrivilege 4636 mcsft.exe Token: SeSystemEnvironmentPrivilege 4636 mcsft.exe Token: SeChangeNotifyPrivilege 4636 mcsft.exe Token: SeRemoteShutdownPrivilege 4636 mcsft.exe Token: SeUndockPrivilege 4636 mcsft.exe Token: SeManageVolumePrivilege 4636 mcsft.exe Token: SeImpersonatePrivilege 4636 mcsft.exe Token: SeCreateGlobalPrivilege 4636 mcsft.exe Token: 33 4636 mcsft.exe Token: 34 4636 mcsft.exe Token: 35 4636 mcsft.exe Token: 36 4636 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
040fe7c98a63b2958d13431044461740_NeikiAnalytics.exemcsft.exemcsft.exepid process 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe 3756 mcsft.exe 4636 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
040fe7c98a63b2958d13431044461740_NeikiAnalytics.execmd.exemcsft.exedescription pid process target process PID 3004 wrote to memory of 3340 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe cmd.exe PID 3004 wrote to memory of 3340 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe cmd.exe PID 3004 wrote to memory of 3340 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe cmd.exe PID 3340 wrote to memory of 4240 3340 cmd.exe reg.exe PID 3340 wrote to memory of 4240 3340 cmd.exe reg.exe PID 3340 wrote to memory of 4240 3340 cmd.exe reg.exe PID 3004 wrote to memory of 3756 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe mcsft.exe PID 3004 wrote to memory of 3756 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe mcsft.exe PID 3004 wrote to memory of 3756 3004 040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe PID 3756 wrote to memory of 4636 3756 mcsft.exe mcsft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\040fe7c98a63b2958d13431044461740_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oleds.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4224,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oleds.txtFilesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
C:\Users\Admin\AppData\Roaming\mcsft.txtFilesize
3.8MB
MD5c1b5457dcf791b398483f964b19685d6
SHA1c11ef07b8d53a9470c93e1cdd73780bdfb06af9f
SHA256ba51e923a134b9a4fa74b57967c1cf8eac756c142914bf73069cee0dd6e31dcf
SHA51239a095b82d246036a0dc683557a04a3913b1438e940709295e096981570dfae0065f652ccc2b3acd2770cd6da806934b4731bf99c5fb370ab97f834948f44ebb
-
memory/3004-0-0x0000000000400000-0x00000000007C5000-memory.dmpFilesize
3.8MB
-
memory/4636-38-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-45-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-37-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-36-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-39-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-40-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-43-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-42-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-41-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-31-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-44-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-34-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-46-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-47-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-48-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-49-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-50-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-51-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-52-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-53-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-54-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/4636-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB