Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
01/06/2024, 22:38
General
-
Target
04b65e15ba112836a00aa7e6d60efcd0_NeikiAnalytics.exe
-
Size
2.4MB
-
MD5
04b65e15ba112836a00aa7e6d60efcd0
-
SHA1
1865bb860b7b09c7063c621b7295350e7e226073
-
SHA256
cf08bebd3005d65e99f6a19541ad3a12d88fd3c6e7128211261a87e8d1cda5f7
-
SHA512
e39474d74e43f4f87971592f2cb85b052e88f70b8a3cadd3835a3aff46e5c9ea93502afec46264147f6a221d7ae37488df3ca012165722b289e96223ca8c53c0
-
SSDEEP
49152:6PnJ/xHxf7AXajsgDgiixRHJSU8PvTY3ni0WFQI4vHq3dp:QnJ/DAbDNB8PM3W34vKt
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b65e15ba112836a00aa7e6d60efcd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\04b65e15ba112836a00aa7e6d60efcd0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
-
Filesize
8KB
-
Filesize
688KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB