Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 03:56
Behavioral task
behavioral1
Sample
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
26cb45640e6ba9d849fae3c4f07540c0
-
SHA1
33484e4dea56c2d05bf6f3d2199e04bd81ed9fca
-
SHA256
1baf8d6a6a4992bc42f10b5e0c10dc6eee1c53178d31e40525e12865f39dec62
-
SHA512
7ee818e876b82476f8943e7980e985774332398165dbcfea3b8a37f4421f4cd72125fe2c6c69fe575f53462482f816bdf0607e0eddcc7fcd06056bb73e918468
-
SSDEEP
49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVA:+XzhW148Pd+Tf1mpcOldJQ3/VA
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 332 explorer.exe 2848 spoolsv.exe 1728 svchost.exe 3756 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/4912-0-0x0000000000400000-0x0000000000A16000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/332-10-0x0000000000400000-0x0000000000A16000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/2848-19-0x0000000000400000-0x0000000000A16000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/1728-28-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3756-33-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/3756-38-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/2848-41-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/4912-42-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/332-43-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/1728-44-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/1728-48-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/1728-54-0x0000000000400000-0x0000000000A16000-memory.dmp themida behavioral2/memory/332-55-0x0000000000400000-0x0000000000A16000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 332 explorer.exe 2848 spoolsv.exe 1728 svchost.exe 3756 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\resources\themes\explorer.exe 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exepid process 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe 332 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 332 explorer.exe 1728 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe 332 explorer.exe 332 explorer.exe 2848 spoolsv.exe 2848 spoolsv.exe 1728 svchost.exe 1728 svchost.exe 3756 spoolsv.exe 3756 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 4912 wrote to memory of 332 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 4912 wrote to memory of 332 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 4912 wrote to memory of 332 4912 26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe explorer.exe PID 332 wrote to memory of 2848 332 explorer.exe spoolsv.exe PID 332 wrote to memory of 2848 332 explorer.exe spoolsv.exe PID 332 wrote to memory of 2848 332 explorer.exe spoolsv.exe PID 2848 wrote to memory of 1728 2848 spoolsv.exe svchost.exe PID 2848 wrote to memory of 1728 2848 spoolsv.exe svchost.exe PID 2848 wrote to memory of 1728 2848 spoolsv.exe svchost.exe PID 1728 wrote to memory of 3756 1728 svchost.exe spoolsv.exe PID 1728 wrote to memory of 3756 1728 svchost.exe spoolsv.exe PID 1728 wrote to memory of 3756 1728 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26cb45640e6ba9d849fae3c4f07540c0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:3756
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Resources\Themes\explorer.exeFilesize
2.6MB
MD50da976de439c91688a24b2f4f4af6105
SHA195e5f4a3c1f509541e75a36eee1203b95eaf261a
SHA256ebc7ca31819afef46f6aefa598ba262a284de22e28f07112f0fb61ca20013517
SHA5125921a39cab247d5113879a61667a739ecfd2d61568d53c19c92052c8ef83392830c99c0617a65393895f06ea525ba58630e705e5644c12646b0cb3e543319c66
-
C:\Windows\Resources\spoolsv.exeFilesize
2.6MB
MD5accbe7640722213ea3ed72483ac5856c
SHA10d82cc8891359a050c18b65503af2ac336fce70f
SHA2560268a11bd9007a709b653eaa9b0fe09aa644fb8696329e7b82b3670677b19598
SHA5128e9251ca904aa7581ba0afc7a09249a4c9ccdc91aab7ca283e81117027e1f9e5aeae70ad7fb1313d821053250cab0352facf9cff84670e25e7a2a3af99b9434e
-
C:\Windows\Resources\svchost.exeFilesize
2.6MB
MD55e384d928b8dda2eac384ea0d305fec9
SHA1c314e9b59876666c6c7caa8eb2023246b9e20668
SHA2562fe41c462de73f3763d8b6fa3464b5856cae2adf61b073c2366476b0f199902c
SHA5125ddbfc698d83bb48ebb335b713579f6774eed9fcb2326b90072b3a65a758d328ba08647687e3cb5d01aee229caccf8252eeae17530b27e01c39a619052583f14
-
memory/332-43-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/332-10-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/332-55-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/1728-44-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/1728-28-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/1728-48-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/1728-54-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2848-41-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/2848-19-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3756-33-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/3756-38-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/4912-42-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/4912-0-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/4912-1-0x0000000077BC4000-0x0000000077BC6000-memory.dmpFilesize
8KB