Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 23:17
Static task
static1
Behavioral task
behavioral1
Sample
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
c1d783218c08ec713b483b0e51da0140
-
SHA1
5d5ab698f686b9f35aec0a27228f9459f7574a6b
-
SHA256
752cd626a9f3e937dbfc5d0f51615df342517a44ea5ae382931e44b1e583d042
-
SHA512
8899bdacaecb9b4dde82316da0034d40d540413763bfa9565338ad86d4a4adc7adeb29a60a1c872432fb537b493e0bf4da6c422f89a32f44a76b5a5859edcdda
-
SSDEEP
24576:6AHnh+eWsN3skA4RV1Hom2KXMmHaYDBNkmBRGEMdSR5ADIAsG/jJ45U:Nh+ZkldoPK8YaZSeIAmU
Malware Config
Extracted
nanocore
1.2.2.0
bnow.duckdns.org:4156
fc4000c4-f8ec-42dc-a0ad-1edfd7548ceb
-
activate_away_mode
true
-
backup_connection_host
bnow.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-08-20T04:39:27.808758936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4156
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fc4000c4-f8ec-42dc-a0ad-1edfd7548ceb
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bnow.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
igfxEM.exeigfxEM.exepid process 1260 igfxEM.exe 2712 igfxEM.exe -
Loads dropped DLL 2 IoCs
Processes:
igfxEM.exeigfxEM.exepid process 1260 igfxEM.exe 2712 igfxEM.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\WinSAT\igfxEM.exe autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exeigfxEM.exeigfxEM.exedescription pid process target process PID 1712 set thread context of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1260 set thread context of 2280 1260 igfxEM.exe RegAsm.exe PID 2712 set thread context of 1944 2712 igfxEM.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2632 schtasks.exe 2600 schtasks.exe 2708 schtasks.exe 308 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegAsm.exepid process 2272 RegAsm.exe 2272 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2272 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2272 RegAsm.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exeRegAsm.exetaskeng.exeigfxEM.exeigfxEM.exedescription pid process target process PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1712 wrote to memory of 2272 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 2272 wrote to memory of 2632 2272 RegAsm.exe schtasks.exe PID 2272 wrote to memory of 2632 2272 RegAsm.exe schtasks.exe PID 2272 wrote to memory of 2632 2272 RegAsm.exe schtasks.exe PID 2272 wrote to memory of 2632 2272 RegAsm.exe schtasks.exe PID 1712 wrote to memory of 2600 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 1712 wrote to memory of 2600 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 1712 wrote to memory of 2600 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 1712 wrote to memory of 2600 1712 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 2612 wrote to memory of 1260 2612 taskeng.exe igfxEM.exe PID 2612 wrote to memory of 1260 2612 taskeng.exe igfxEM.exe PID 2612 wrote to memory of 1260 2612 taskeng.exe igfxEM.exe PID 2612 wrote to memory of 1260 2612 taskeng.exe igfxEM.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2280 1260 igfxEM.exe RegAsm.exe PID 1260 wrote to memory of 2708 1260 igfxEM.exe schtasks.exe PID 1260 wrote to memory of 2708 1260 igfxEM.exe schtasks.exe PID 1260 wrote to memory of 2708 1260 igfxEM.exe schtasks.exe PID 1260 wrote to memory of 2708 1260 igfxEM.exe schtasks.exe PID 2612 wrote to memory of 2712 2612 taskeng.exe igfxEM.exe PID 2612 wrote to memory of 2712 2612 taskeng.exe igfxEM.exe PID 2612 wrote to memory of 2712 2612 taskeng.exe igfxEM.exe PID 2612 wrote to memory of 2712 2612 taskeng.exe igfxEM.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 1944 2712 igfxEM.exe RegAsm.exe PID 2712 wrote to memory of 308 2712 igfxEM.exe schtasks.exe PID 2712 wrote to memory of 308 2712 igfxEM.exe schtasks.exe PID 2712 wrote to memory of 308 2712 igfxEM.exe schtasks.exe PID 2712 wrote to memory of 308 2712 igfxEM.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1A16.tmp"3⤵
- Creates scheduled task(s)
PID:2632 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2600
-
C:\Windows\system32\taskeng.exetaskeng.exe {2A2E21C0-E0E2-4745-AF54-CD9F2496DEAF} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\WinSAT\igfxEM.exeC:\Users\Admin\WinSAT\igfxEM.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:2280
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2708 -
C:\Users\Admin\WinSAT\igfxEM.exeC:\Users\Admin\WinSAT\igfxEM.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1944
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1A16.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\WinSAT\igfxEM.exeFilesize
1.4MB
MD5114ad6f77c3d291cfe8c2d46f7a4ee5e
SHA14e4d0e7bb922cadcd39c0820bd0293a4a01d2fff
SHA256bf6b0e02968afc5cab435db2cf9855a927068d89449bd40c3bdcc3b2c3e2bac8
SHA512d7c5fe0367dc9698e2971cc64b204db642233b4e46b636c823e70b03afc7857a2fb2f1d33d034014bb4a28f3e78650e44133f52601edaa33581a5d297591dd7c
-
C:\Users\Admin\azroles.lnkFilesize
723B
MD5000ecb8e0fd30111e5407661de38850f
SHA101b98e2649156aee219799c87a45911a38204853
SHA256f3767405dac3cb30f918316c40b9b88d1e00595ceda0b33a75956b0a15a8e523
SHA5126c4eaa9b51400bb5b9f71a2d6d00a64d8ee97ad0c6f389147bdedc2857bf26c8693fab96ab1b19485a3395097bafe9ee4e22cdf6db5113ea113e7a9917622480
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1712-0-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/2272-10-0x00000000741C2000-0x00000000741C4000-memory.dmpFilesize
8KB
-
memory/2272-2-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2272-8-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2272-15-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/2272-19-0x00000000741C2000-0x00000000741C4000-memory.dmpFilesize
8KB
-
memory/2272-20-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/2272-9-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2272-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2272-1-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB