Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27/05/2024, 00:02
General
-
Target
0e804542da7a57970b1f172c0c8a9270_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
0e804542da7a57970b1f172c0c8a9270
-
SHA1
800d9d626bed009ba35bd343a18b3b89ec5e3f41
-
SHA256
93d839ef139cbf96de1bac7818ca26b8f03c2941c142d7c6df3415cba69c64c0
-
SHA512
568f207d81cb6d06b01518d85c509b0b8958e5674e04f2e66c4b2e7e3c668c7049e816e35846a6e2dc4b0ec32720b97ef8b2d257787ad9362ac68028fb5f1899
-
SSDEEP
49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx2:dxx9NUFkQx753uWuCyyx2
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e804542da7a57970b1f172c0c8a9270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0e804542da7a57970b1f172c0c8a9270_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5ba5eaab11631f59a4785fb30271fdaaa
SHA1864bf1661d5d770d2f5f11e1c59fba43b4b75511
SHA256f7925c655b1ba79ef33787487d60a53b4054e23b0153ef129f86f22fd65df521
SHA5129ed06f845bcaa3c9e7e02c642bb98cfed4ca378d672b05208583aed7f43f944ba6756db9b8b7a16458ff0b0c9bd34584b619ceddd6d981af2e41fdb6b5fa82aa
-
Filesize
2.5MB
MD5a0b0f43ca7778c298fadb676c47b5e4e
SHA1e6eab482e07d5cd952c1ea6b53804168146b0244
SHA256ad31f3caca5a32dc95bc4dafe49451170840f86b305fe7239ca7dd9e9388a366
SHA512799188115dad2ee1b21699ab3e19e73aa3ce6396d1614083d40d0b304e9bc404d6861cd07feeb7e684de8b0ff6dbed5a24c37ca6da99451208f25be01556a913
-
Filesize
2.5MB
MD531a2aed37d02b2aafd748b760ecc4377
SHA1e17bfae90fac7f57c1560c9ce782aaaf1c105cff
SHA25640bdc81cd02255f65c195f1b2a3cae5f262c8c21eab8e06af702d43391d2fef1
SHA5120d694e7376cb0e6a35e9353e8dfb6874b83be69ff1d3f445c1fa2a51d8876451aff26cfc1a1e705742199aa4297f39398fcb29a66adab02db5a702be64a55515
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB