Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09-06-2024 05:21

General

  • Target

    10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    10d1c4883ccc8186cf3a868b3eab2340

  • SHA1

    de2563ea862e31820485bf9dd80c2f2a64b84ba1

  • SHA256

    0c0245cc8321bea32eeec4dea5505bc5dcd4579297f95d40dfe86e7811de4538

  • SHA512

    c4127e061262d4cb8103693adc38176d0f58abd9bb1f7b8c126a03040fa9b325102ce94d400571b3013364cd85db011f6f91b58bc58e9595d44153572c5e7152

  • SSDEEP

    49152:VtzBOauT0i7ZSQcCG1+bLthSo9/ktjPf4EXzwgb+LquT05Z:VtzaT00zcC8ahhSo9sRf44z1/5Z

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 19 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2428
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2080
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2448
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2360
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2664
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:23 /f
            5⤵
            • Creates scheduled task(s)
            PID:2676
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:24 /f
            5⤵
            • Creates scheduled task(s)
            PID:1568
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:25 /f
            5⤵
            • Creates scheduled task(s)
            PID:2312
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      2.7MB

      MD5

      be9472b2a28c362e6649f79eda49c157

      SHA1

      dd646c572bc170da250a08892c32ed0934aa4d51

      SHA256

      0f3299572a38c10d501936f095da18b2fc6d668729b0a3dddd01fef068e22e41

      SHA512

      f1b0192f0dea2305b70570c0a4c6f9f09aad145e5c5545580c5fdc9d7492ee115ed797b1a3d0908ab2c5a6a50f2bddb5082090a5adc44c5d8e567fcc1b57e717

    • \Windows\Resources\spoolsv.exe

      Filesize

      2.7MB

      MD5

      f07a5b5af505ac08d979e048fba849e1

      SHA1

      07d0d4b09e1054022e16881f9172fe670e3e4b45

      SHA256

      0017c0e4f0f80cc65db0fc7ffbb9a9795162e56bf229e88f7a742167dbb1c197

      SHA512

      0e21f09df509aea3927c665a945f29d772c18eb1c10ba1276b3ee3af65bc898605e8e314b5b4c04253e12bb0c2df3959e665cf9887b18c20b0c0871aa81ab797

    • \Windows\Resources\svchost.exe

      Filesize

      2.7MB

      MD5

      44ee2b9801d077645292d930f48844ab

      SHA1

      7151571ab0aa7d4abffe27123d2e17e59f5c76b1

      SHA256

      e4f43c2ef5c746f419f6c22dff41bdeae2f948a3b7d48a0b3aefebd19a9ce783

      SHA512

      329ad864f41ceecd91f0d59b9596f93d6ad8f927d6f69ffd449ced04b85bfae924da5e9cd392f120a67d792cc7157f75d9ec779f7e2fcb9313438d3f3eac95de

    • memory/2080-67-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2080-56-0x00000000038D0000-0x0000000003F30000-memory.dmp

      Filesize

      6.4MB

    • memory/2080-12-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2080-53-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2080-22-0x00000000038D0000-0x0000000003F30000-memory.dmp

      Filesize

      6.4MB

    • memory/2360-36-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2360-55-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2360-78-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2360-72-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2428-52-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2428-43-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2428-11-0x00000000036D0000-0x0000000003D30000-memory.dmp

      Filesize

      6.4MB

    • memory/2428-1-0x00000000770B0000-0x00000000770B2000-memory.dmp

      Filesize

      8KB

    • memory/2428-0-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2448-51-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2448-35-0x0000000003640000-0x0000000003CA0000-memory.dmp

      Filesize

      6.4MB

    • memory/2448-24-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2664-50-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB

    • memory/2664-44-0x0000000000400000-0x0000000000A60000-memory.dmp

      Filesize

      6.4MB