Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 05:08

General

  • Target

    28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe

  • Size

    2.5MB

  • MD5

    28ac907d06f0fd383ccfbba6595615b0

  • SHA1

    b07e1f1492fa23da54e04ead3c3e7eea5ffbdcdd

  • SHA256

    a0a2ff1c76bd92bbd57142414f481c18176ec907002703cf940da0b20361fc8e

  • SHA512

    58aff6acb313a6bbcfaa3bcfcf953094a04d6c2a722356aff0d4d69687f2b7765cfa5922f32bf29d1ba7bf167fcb137db9b91d10cff636db8d971a49b1d57bc1

  • SSDEEP

    49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:hxx9NUFkQx753uWuCyyxg

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 15 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2820
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2988
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2656
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2832
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2728
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:10 /f
            5⤵
            • Creates scheduled task(s)
            PID:2916
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:11 /f
            5⤵
            • Creates scheduled task(s)
            PID:2280
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:12 /f
            5⤵
            • Creates scheduled task(s)
            PID:1796
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe
      Filesize

      2.5MB

      MD5

      459870793a9ba032a8eb5516071091e8

      SHA1

      0ce82e616f368a0d4451c2d41d7985a01e5f20e9

      SHA256

      111b0a5034249ed54f291f1dbb8395da33e3ed2b3b5a44e84e6320667631050c

      SHA512

      07919682087eeeae743d2786eef1c0bbbeb88f32a73e15b6e8f244738eb5902be9eea11dcdcedeff050e3142953eb38798adc94cb7fbc0655d5da5e557c71ce6

    • \Windows\Resources\Themes\explorer.exe
      Filesize

      2.5MB

      MD5

      d54c61be3b1e184ff8c495663564934e

      SHA1

      8faab9aaba40ce01d014f433816684df69314278

      SHA256

      02f650f5969ac53ac40acb38b8465575b6da9da38e472dabad621e5ff9001960

      SHA512

      2f5de48f378b75bea95062540698db89aba22ae5188a5d6bc28287b51601d5423437bc663a4906cecc21fb04afd6cb124edbc94718659a6316d2b94a914966a3

    • \Windows\Resources\svchost.exe
      Filesize

      2.5MB

      MD5

      ef127446cbc51b2c74a3d1cc6f58b703

      SHA1

      37cac3a489518f9ed4f6fff84f04e0d997a65d01

      SHA256

      e722b992b8a79bebbf062678667a8e79d7f6d71a8b1e44843318c8315d5edd69

      SHA512

      dbdc6f3bec492ab2936a464dc9009a0e7218c1f295d8aa927700309ce4832ed2b2779d48b134e973a1176e0395db94dd00ff8e8ea87ea04559c7f332bca77c43

    • memory/2656-50-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2656-33-0x0000000003870000-0x0000000003E7E000-memory.dmp
      Filesize

      6.1MB

    • memory/2656-23-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2728-43-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2728-49-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2820-0-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2820-1-0x0000000077820000-0x0000000077822000-memory.dmp
      Filesize

      8KB

    • memory/2820-52-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2832-35-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2832-42-0x00000000032C0000-0x00000000038CE000-memory.dmp
      Filesize

      6.1MB

    • memory/2832-55-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2832-59-0x00000000032C0000-0x00000000038CE000-memory.dmp
      Filesize

      6.1MB

    • memory/2988-21-0x0000000003780000-0x0000000003D8E000-memory.dmp
      Filesize

      6.1MB

    • memory/2988-11-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2988-53-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2988-56-0x0000000003780000-0x0000000003D8E000-memory.dmp
      Filesize

      6.1MB

    • memory/2988-68-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB

    • memory/2988-74-0x0000000000400000-0x0000000000A0E000-memory.dmp
      Filesize

      6.1MB