Overview

overview

7

Static

static

3

2953032d3e...cs.exe

windows7-x64

7

2953032d3e...cs.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$_2_/BDDLBHO.dll

windows7-x64

6

$_2_/BDDLBHO.dll

windows10-2004-x64

6

$_2_/BDIEHelper.dll

windows7-x64

1

$_2_/BDIEHelper.dll

windows10-2004-x64

1

$_2_/BaiduMiniDL.exe

windows7-x64

6

$_2_/BaiduMiniDL.exe

windows10-2004-x64

6

$_2_/Basic.dll

windows7-x64

3

$_2_/Basic.dll

windows10-2004-x64

3

$_2_/BugReport.exe

windows7-x64

1

$_2_/BugReport.exe

windows10-2004-x64

1

$_2_/Protocol.dll

windows7-x64

1

$_2_/Protocol.dll

windows10-2004-x64

1

$_2_/Report.dll

windows7-x64

1

$_2_/Report.dll

windows10-2004-x64

1

$_2_/Update.dll

windows7-x64

1

$_2_/Update.dll

windows10-2004-x64

1

$_2_/Update.exe

windows7-x64

1

$_2_/Update.exe

windows10-2004-x64

1

$_2_/dl.dll

windows7-x64

1

$_2_/dl.dll

windows10-2004-x64

1

$_2_/npBDDLPlug.dll

windows7-x64

3

$_2_/npBDDLPlug.dll

windows10-2004-x64

3

$_2_/uninstaller.exe

windows7-x64

7

$_2_/uninstaller.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2024, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2953032d3e8083333fbbe91041feddc0_NeikiAnalytics.exe
  • Size 1.5MB
  • Sample240605-cf2ylabg45
  • SHA256 61412215fb26d53852080768f435afcfa050319f0431cc1c4f0ac6e203eeb5e2
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarebootkitdiscoverypersistencestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2953032d3e8083333fbbe91041feddc0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2953032d3e8083333fbbe91041feddc0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe
      "C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2960

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InstallHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nst441F.tmp\InstallHelper.dll
        • Size 80KB
        • SHA256 53c9cd1bbb9c595708ff00297694492135202649066551a354f0f8475e4c41c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BDDLBHO.dll
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\BDDLBHO.dll
        • Size 199KB
        • SHA256 20a792f1c76588866a9e0667c4d74e4c8123a1a55eb0956b93fcdf3109c153e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BDIEHelper.dll
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\BDIEHelper.dll
        • Size 323KB
        • SHA256 6b894c1f5de423d08f5f28bcb52c95589c1a474c75f90563606f440d9a668125
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BaiduMiniDL.exe
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe
        • Size 555KB
        • SHA256 f2bbf8e694843c144d0df7f26c27105ffff36a7bfbde39811f2740f2339e276f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Basic.dll
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\Basic.dll
        • Size 443KB
        • SHA256 7d0b68fa571ab446ce2622c220644bfe7f61f72020e70bbdb138458b0dd06ce1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Protocol.dll
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\Protocol.dll
        • Size 563KB
        • SHA256 34a223dcc8ca4c834a5918a8d7626b1c4d16205b65e5c82e83fd0f2966be8856
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Report.dll
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\Report.dll
        • Size 199KB
        • SHA256 63442dbc6be0ce4aa233ae265f15fea2d3dcbd09ee5799bb58ac49450cffdea2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\config.ini
        • Size 363B
        • SHA256 71f84f6a0f2848e5b51380808ac102eab741e9d55f5cc8b21a65f2b53d41286e
        • MD5 SHA1 SHA512
        Submit Download

        dl.dll
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\dl.dll
        • Size 1.9MB
        • SHA256 109cdc7ab3650386d91803bc38a6ae6b061a182ff57105ec00be641e9a70f17e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        buttonpath.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\buttonpath.png
        • Size 287B
        • SHA256 e06a763a9a4f7e7f892371b7b0d8d75a646585f7e94afe96c64b34d067f89471
        • MD5 SHA1 SHA512
        Submit Download

        close.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\close.png
        • Size 872B
        • SHA256 657bc0eac3efda11154ed7459cbe6be18bfd35a57dfc74de1462beee927758f1
        • MD5 SHA1 SHA512
        Submit Download

        config.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\config.png
        • Size 1KB
        • SHA256 49054a271dee8fa537abbabdf51ff9ff344730f9b220e2836ef5a413a55acc06
        • MD5 SHA1 SHA512
        Submit Download

        download.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\download.png
        • Size 476B
        • SHA256 a764be59fc441edcf556cbdfa8a88c2a61d85755dec568033181cec259de80a9
        • MD5 SHA1 SHA512
        Submit Download

        error.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\error.png
        • Size 99B
        • SHA256 5d02a4d8d5369c5510b6e48381662915850ba71f4bcf463e49f11112da4d55fd
        • MD5 SHA1 SHA512
        Submit Download

        loading.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\loading.png
        • Size 99B
        • SHA256 949f346fb21087d2f39ff02b2eab49f4b298480e013e84efc34a134f7666dd1b
        • MD5 SHA1 SHA512
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\logo.png
        • Size 971B
        • SHA256 ad801e96ea10f05a704329a685d9743eb364eec2766689ef115415f5bdc0a30d
        • MD5 SHA1 SHA512
        Submit Download

        mainbnd.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\mainbnd.png
        • Size 792B
        • SHA256 c6d6eccd6de98a2c728b8a5276eb9eff8ee118aee22b2b04426c5fd3ef273998
        • MD5 SHA1 SHA512
        Submit Download

        min.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\min.png
        • Size 353B
        • SHA256 85ccfff45347ae28d8e86f55b7f55481e024eadd0e8164725723d80191a93833
        • MD5 SHA1 SHA512
        Submit Download

        path.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\path.png
        • Size 81KB
        • SHA256 e7f035cb1bc7c2b0961eefc2c4ad80252efda45ae4279b28f1287a1e7feede34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pause.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\pause.png
        • Size 476B
        • SHA256 07600e1f3ca1b55d0ae1253d88db0d57e75380a735db1f7b33b5fd3ecfb14e8d
        • MD5 SHA1 SHA512
        Submit Download

        progressbar_bk.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\progressbar_bk.png
        • Size 103B
        • SHA256 e39b1f8c487b20fe81f4cadded3dd225df0352b8b3beb9f18b9571179e9dcf86
        • MD5 SHA1 SHA512
        Submit Download

        softlogo_1.png
        • Path C:\Users\Admin\AppData\Roaming\baidu\BaiduMiniDownloader\1.0.1.2\image\softlogo_1.png
        • Size 7KB
        • SHA256 019bb4ef81de698251f1d76643bac2cff8bb832766e03bba749d14715bc5b24d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2960-81-0x0000000000A50000-0x0000000000ABF000-memory.dmp
        Download

        memory/2960-87-0x0000000002690000-0x000000000271E000-memory.dmp
        Download

        memory/2960-110-0x0000000004660000-0x000000000484D000-memory.dmp
        Download