Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 05:42
Static task
static1
Behavioral task
behavioral1
Sample
20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe
-
Size
73KB
-
MD5
20fbc3b59ed965f32cc1082c9e126f00
-
SHA1
1d9910776dde0bd3c7a304c9cb3bd13436667af5
-
SHA256
9d3e4595161ea440e54d7bb3778127f0cbc4c636455527b9a4f86ed7052d328c
-
SHA512
42e8be26ba9046f3a5417019401bf814b1a0ba4f614c3eb60bc1a24f0f926ff4781abf4b863f3e3a53ed415a29fe1236bd01c29c913dbe5c6f9ffb77cc374257
-
SSDEEP
768:qGHV45EDE477AZbUJx0rZGE3jCELoiMMj6hZ3nE+EXVmkDbjRL8Khc15Z6J1S:qG14P477AxUYrZGoC09k0SkTRHhWqP
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 27 3692 rundll32.exe 28 3692 rundll32.exe 37 3692 rundll32.exe -
Deletes itself 1 IoCs
Processes:
hqchgyh.exepid process 3092 hqchgyh.exe -
Executes dropped EXE 1 IoCs
Processes:
hqchgyh.exepid process 3092 hqchgyh.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3692 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\zpamcraoe\\myzlo.dll\",init" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\t: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 3692 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exehqchgyh.exepid process 1788 20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe 3092 hqchgyh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.execmd.exehqchgyh.exedescription pid process target process PID 1788 wrote to memory of 1468 1788 20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe cmd.exe PID 1788 wrote to memory of 1468 1788 20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe cmd.exe PID 1788 wrote to memory of 1468 1788 20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe cmd.exe PID 1468 wrote to memory of 1752 1468 cmd.exe PING.EXE PID 1468 wrote to memory of 1752 1468 cmd.exe PING.EXE PID 1468 wrote to memory of 1752 1468 cmd.exe PING.EXE PID 1468 wrote to memory of 3092 1468 cmd.exe hqchgyh.exe PID 1468 wrote to memory of 3092 1468 cmd.exe hqchgyh.exe PID 1468 wrote to memory of 3092 1468 cmd.exe hqchgyh.exe PID 3092 wrote to memory of 3692 3092 hqchgyh.exe rundll32.exe PID 3092 wrote to memory of 3692 3092 hqchgyh.exe rundll32.exe PID 3092 wrote to memory of 3692 3092 hqchgyh.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&c:\hqchgyh.exe "C:\Users\Admin\AppData\Local\Temp\20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
-
\??\c:\hqchgyh.exec:\hqchgyh.exe "C:\Users\Admin\AppData\Local\Temp\20fbc3b59ed965f32cc1082c9e126f00_NeikiAnalytics.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\zpamcraoe\myzlo.dll",init c:\hqchgyh.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\hqchgyh.exeFilesize
74KB
MD5bca85e9b2ddb49a9f782b473a77677af
SHA10953b2762b69fb6f55279ed4f855646d99d3a541
SHA256ff441747992ac43cdabcd7ad570742c6159cb44eaa2af3768b982e1612a2ffbc
SHA512ae585f0114d4fa5f3432435c7c354f43b49dc7500452630e8a599b77896ae386e699de6c9492c13a96ce4493cd85ea3767abfa38b316d11256a367496afe4ad0
-
\??\c:\zpamcraoe\myzlo.dllFilesize
42KB
MD536e3fb5964d663272cf1169e1e1ca478
SHA158115e08b49505bcbbb5c88a28a86222ba18d5d4
SHA256c7c41689de030df0f78f471422fa2a6383b36e77c94e7f6f124a96feb3e27ed7
SHA512daff53b11aa400437a06287707a334a09661c1ef7d0fd8beaf1a874c79c16fe45bd1188343d0623e839d3ead5ea2dd90896e37ccf3b252c7220c74989a9ba442
-
memory/1788-0-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1788-1-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/1788-3-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3092-10-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3092-8-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/3092-7-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/3692-13-0x0000000010000000-0x000000001002E000-memory.dmpFilesize
184KB
-
memory/3692-14-0x0000000010000000-0x000000001002E000-memory.dmpFilesize
184KB
-
memory/3692-15-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/3692-16-0x0000000010000000-0x000000001002E000-memory.dmpFilesize
184KB
-
memory/3692-17-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB