Analysis
-
max time kernel
146s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
01-06-2024 22:21
General
-
Target
023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
023f97a2ae47b83f90788d0733a00330
-
SHA1
df2dee6db040c44db1ba770fd3e2f8ad8ce0bdc0
-
SHA256
be6ba8b6e1bb8716515070f1018f37a9553f3c453e269b63171699cba5ee478f
-
SHA512
3cd67b4626bf584213fb953952832b6ac3a1a47c225a2aec7865c27e0a1b708ffefab9763142253bf39b0144c0b85561e761040f9b03c92fc7bbd7938e8b4b07
-
SSDEEP
49152:DpPNiqTVoiCVsqSMRrQFTAm4o24TduMpwNRL:NNiqpcsFCrQFEm40vpw3
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5018b8ca9396fc1781ee8c2e2f0dd899f
SHA1bad8aeae08bcc1ce268a298fa7fdb67bf4bd36cd
SHA256f573d906c7581ac04f8be409b2a4522758da43a8d43e3fe9c7391d700ad1983b
SHA51208fd852746f9c0443a14e8c5bea48ae849ee1eadef38ec47305be82d6286d511686d08a5b31ede20e3dffe8b3c389b3717c1607c77ede64d60bf8ac69e4ae0c4
-
Filesize
1.7MB
MD5fc467958db05206abc54f7643d02151a
SHA1713453715ee2a7c4f2f83a5a34331ed672cb3073
SHA256747c5d0834d777fe2feb50296b0eff8ebeb0569a3d97e46eca8c0cc1d8cad3f6
SHA512e5ac918483985fc3b0d31e027df2fadfc9d9af1f112e010325b558a1213abbdeac6d533f7ad9dbc5779ce5562e875a094d8883d6b6a4dbd9aad28ca02e14a1b1
-
Filesize
1.7MB
MD58881c811b1c85cffa6d3f123eccfe076
SHA11f7b895400a2b77bc7faed38bc74f38f69fb1ab3
SHA2563ea0e8dace8076ea11e09ad1e08d0fb23487afc31fb0cb81dcb9de8b46102035
SHA5129f8e8622365d231e35b326d9f15e635cdcf232704ca98469e7fd83b7b75adf6e3e6917b6a9767c3a5d1d97c594b395a50647f4796525b1ccfd99ddec03c943d2
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB