Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 22:20

General

  • Target

    1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe

  • Size

    2.5MB

  • MD5

    1d7c209d3fe49b48f00d22a367a25d20

  • SHA1

    e188291b372a858870658efc1d965f04f89cbeb1

  • SHA256

    b9264329c052618a08c48ba39c16263c7e06af5dee8704d78d73222cb820e4c6

  • SHA512

    a55c758417613332c6f68fa1405906e4c673bebd4827cc52797c5e6fe8ff65ad34468f8a932528d8ea672db7bb0c8b652d183542828f3b587d4867b12548ce29

  • SSDEEP

    49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx4:hxx9NUFkQx753uWuCyyx4

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 17 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1752
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2424
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2348
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2824
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2944
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:22 /f
            5⤵
            • Creates scheduled task(s)
            PID:2548
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:23 /f
            5⤵
            • Creates scheduled task(s)
            PID:1308
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:24 /f
            5⤵
            • Creates scheduled task(s)
            PID:1864
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe
      Filesize

      2.5MB

      MD5

      7c94076d32d1bceb07e5f96dcb101084

      SHA1

      d6ec35f4d904c715dd30a7ed683b2d15606237ad

      SHA256

      28c350e4a3a6852385a54609dc3d7f8cb01680403c830191b5a2cceb8975d946

      SHA512

      7ff7a212a5ab27c1d0e8571cf76647606e2f0ddc4cd6d6bbb26943899bec82a1b1dd1fc7a1a804f01bf118e275d0c4140c05c7f4e19bd981d5aaf1af65c8d093

    • \Windows\Resources\Themes\explorer.exe
      Filesize

      2.5MB

      MD5

      bc1e1901255e68bb7719a13818099d58

      SHA1

      571b4a86d9040db04d2aaa34f12402ebd4fccf4e

      SHA256

      bd619f13564c330721dc8b49c5e844b3502ef4f668eea076e41fbc2c0f1493b5

      SHA512

      f1a10ba0723771a42c9a8a381005527a164cec840e8f19eec81586909429987d8f428a8f8a34e86edaca2992dae8a8e0d70904146bffd9f8343a4cd5ad8c9023

    • \Windows\Resources\svchost.exe
      Filesize

      2.5MB

      MD5

      5704d0324e55747198f0522310b7d4ca

      SHA1

      26646538e84a30c36e3ee2bad88ee0e06dcd16fa

      SHA256

      671334298110a007a19d74496f2c0f08495988c9c74f78f0ba026d4062a4e9ad

      SHA512

      ff4654bf909bc5e12d12d98f8f2463522f6fa63b563adcac3a5d3b880eb89390d3bf4a34184566b3f1726c0dcd49c18f722b9431ed8a7c9e9ba570185929ac06

    • memory/1752-43-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/1752-1-0x0000000077210000-0x0000000077212000-memory.dmp
      Filesize

      8KB

    • memory/1752-52-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/1752-0-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2348-23-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2348-34-0x00000000038A0000-0x0000000003EAE000-memory.dmp
      Filesize

      6.1MB

    • memory/2348-51-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-22-0x00000000036C0000-0x0000000003CCE000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-11-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-53-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-55-0x00000000036C0000-0x0000000003CCE000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-67-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-71-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2424-75-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2824-41-0x0000000003600000-0x0000000003C0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2824-37-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2824-56-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2944-44-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2944-49-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB