c8af236eb4a8fbd13f917aa97df8839a64417d9e5b55d6664c7d018b9bfc1702

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 07:31

Target
251f67868f84adc998e452cca9036a80_NeikiAnalytics.dll
Size 73KB
Sample240527-jchtwadd46
SHA256 c8af236eb4a8fbd13f917aa97df8839a64417d9e5b55d6664c7d018b9bfc1702
MD5 251f67868f84adc998e452cca9036a80
SHA1 c18cdb4f256f4392db5220562f9a1273d6c3ee92
SHA512 9ce4e03526cff6028157a71037e27e86c21ce8a9cd7b09bb3934492fb206f66f89ee2dba0f92064941d05ba6f0a08911ce182fddeff903b18a64da48551d1be5
SSDEEP 1536:hZZZZZZZZZZZZpyORgbwS7FGqmQx1Y7qcJK61hMqqU+2bbbAV2/S2uXKEn:vRGrLY7qct1hMqqDL2/uXK
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qzgxwkuasgy = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bpfrsp.exe\""	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1420	WerFault.exe	91

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1420	4188	rundll32.exe	91
PID 4188 wrote to memory of 1420	4188	rundll32.exe	91
PID 4188 wrote to memory of 1420	4188	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\251f67868f84adc998e452cca9036a80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\251f67868f84adc998e452cca9036a80_NeikiAnalytics.dll,#1
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 624
    3⤵
    - Program crash
    PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
1⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4996