Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 03:56

General

  • Target

    26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe

  • Size

    2.6MB

  • MD5

    26cb45640e6ba9d849fae3c4f07540c0

  • SHA1

    33484e4dea56c2d05bf6f3d2199e04bd81ed9fca

  • SHA256

    1baf8d6a6a4992bc42f10b5e0c10dc6eee1c53178d31e40525e12865f39dec62

  • SHA512

    7ee818e876b82476f8943e7980e985774332398165dbcfea3b8a37f4421f4cd72125fe2c6c69fe575f53462482f816bdf0607e0eddcc7fcd06056bb73e918468

  • SSDEEP

    49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVA:+XzhW148Pd+Tf1mpcOldJQ3/VA

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 18 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2292
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2136
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3040
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2460
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2516
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:58 /f
            5⤵
            • Creates scheduled task(s)
            PID:2352
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:59 /f
            5⤵
            • Creates scheduled task(s)
            PID:1728
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 04:00 /f
            5⤵
            • Creates scheduled task(s)
            PID:2232
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\Resources\Themes\explorer.exe
      Filesize

      2.6MB

      MD5

      e6ce91010089903947d813ac5596443c

      SHA1

      8263dbed4d567fb3c372d9f369035ec3196a5bf6

      SHA256

      0b574b212104251e2d61a00b168bd4c975139260aea47652cf6b719c5999e864

      SHA512

      9beb72520a1fea33b911baaea521f380aeb5c2bd2eeda5d048ba3482794d0fe106a52bc6d01eec3f8dddda9901ea552b2f5c565f6a2f45404c76fdaaf56e0912

    • \Windows\Resources\spoolsv.exe
      Filesize

      2.6MB

      MD5

      161dbde6e122235f18e694b99bc08e6e

      SHA1

      370b9b39176946d93b3f105a4637585eca59a7be

      SHA256

      d42735bcec4ace30764ab4e57d725ca970827066d3886d74f607ef1fde4dbaa4

      SHA512

      5dae1dfbf4756382edc52ecfefdadd36b8bb740691fe5e7d2ecfc295ef94b733649bcc1132cd4645dc74871bb1f87a0a3b708b11e673df63d46b673d9ed24f9e

    • \Windows\Resources\svchost.exe
      Filesize

      2.6MB

      MD5

      8b42612fddb0e5c05635d42b1bade2f0

      SHA1

      15f4bb14b6c81d0fa97e82021771d6204b6280b1

      SHA256

      780e807fe2a1275a00387d0d2891d99793f9e9b40cce0817fb0c4ef8aafcb4c8

      SHA512

      e6de45c407197007787d80bc022e11b5b765ed78a2cdf5598ec9e132d26f49d5c4a53f2d6158ca38b17776481b5e463093eedf765bbaf0192ad66864f4fb93e4

    • memory/2136-72-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2136-66-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2136-12-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2136-21-0x0000000003420000-0x0000000003A36000-memory.dmp
      Filesize

      6.1MB

    • memory/2136-53-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2292-52-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2292-0-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2292-1-0x0000000077D20000-0x0000000077D22000-memory.dmp
      Filesize

      8KB

    • memory/2292-43-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2292-11-0x00000000034F0000-0x0000000003B06000-memory.dmp
      Filesize

      6.1MB

    • memory/2460-57-0x0000000003230000-0x0000000003846000-memory.dmp
      Filesize

      6.1MB

    • memory/2460-48-0x0000000003230000-0x0000000003846000-memory.dmp
      Filesize

      6.1MB

    • memory/2460-54-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2460-61-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2460-36-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/2516-47-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/3040-50-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/3040-24-0x0000000000400000-0x0000000000A16000-memory.dmp
      Filesize

      6.1MB

    • memory/3040-35-0x0000000003560000-0x0000000003B76000-memory.dmp
      Filesize

      6.1MB