Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 23:17
Static task
static1
Behavioral task
behavioral1
Sample
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
c1d783218c08ec713b483b0e51da0140
-
SHA1
5d5ab698f686b9f35aec0a27228f9459f7574a6b
-
SHA256
752cd626a9f3e937dbfc5d0f51615df342517a44ea5ae382931e44b1e583d042
-
SHA512
8899bdacaecb9b4dde82316da0034d40d540413763bfa9565338ad86d4a4adc7adeb29a60a1c872432fb537b493e0bf4da6c422f89a32f44a76b5a5859edcdda
-
SSDEEP
24576:6AHnh+eWsN3skA4RV1Hom2KXMmHaYDBNkmBRGEMdSR5ADIAsG/jJ45U:Nh+ZkldoPK8YaZSeIAmU
Malware Config
Extracted
nanocore
1.2.2.0
bnow.duckdns.org:4156
fc4000c4-f8ec-42dc-a0ad-1edfd7548ceb
-
activate_away_mode
true
-
backup_connection_host
bnow.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2018-08-20T04:39:27.808758936Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4156
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
fc4000c4-f8ec-42dc-a0ad-1edfd7548ceb
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
bnow.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
igfxEM.exec1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exeigfxEM.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxEM.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation igfxEM.exe -
Executes dropped EXE 2 IoCs
Processes:
igfxEM.exeigfxEM.exepid process 812 igfxEM.exe 5020 igfxEM.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\WinSAT\igfxEM.exe autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exeigfxEM.exeigfxEM.exedescription pid process target process PID 3220 set thread context of 1572 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 812 set thread context of 1236 812 igfxEM.exe RegAsm.exe PID 5020 set thread context of 3368 5020 igfxEM.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3944 schtasks.exe 2304 schtasks.exe 1592 schtasks.exe 4496 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exepid process 1572 RegAsm.exe 1572 RegAsm.exe 1572 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1572 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1572 RegAsm.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exeRegAsm.exeigfxEM.exeigfxEM.exedescription pid process target process PID 3220 wrote to memory of 1572 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 3220 wrote to memory of 1572 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 3220 wrote to memory of 1572 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 3220 wrote to memory of 1572 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 3220 wrote to memory of 1572 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe RegAsm.exe PID 1572 wrote to memory of 4496 1572 RegAsm.exe schtasks.exe PID 1572 wrote to memory of 4496 1572 RegAsm.exe schtasks.exe PID 1572 wrote to memory of 4496 1572 RegAsm.exe schtasks.exe PID 3220 wrote to memory of 3944 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 3220 wrote to memory of 3944 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 3220 wrote to memory of 3944 3220 c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe schtasks.exe PID 812 wrote to memory of 1236 812 igfxEM.exe RegAsm.exe PID 812 wrote to memory of 1236 812 igfxEM.exe RegAsm.exe PID 812 wrote to memory of 1236 812 igfxEM.exe RegAsm.exe PID 812 wrote to memory of 1236 812 igfxEM.exe RegAsm.exe PID 812 wrote to memory of 1236 812 igfxEM.exe RegAsm.exe PID 812 wrote to memory of 2304 812 igfxEM.exe schtasks.exe PID 812 wrote to memory of 2304 812 igfxEM.exe schtasks.exe PID 812 wrote to memory of 2304 812 igfxEM.exe schtasks.exe PID 5020 wrote to memory of 3368 5020 igfxEM.exe RegAsm.exe PID 5020 wrote to memory of 3368 5020 igfxEM.exe RegAsm.exe PID 5020 wrote to memory of 3368 5020 igfxEM.exe RegAsm.exe PID 5020 wrote to memory of 3368 5020 igfxEM.exe RegAsm.exe PID 5020 wrote to memory of 3368 5020 igfxEM.exe RegAsm.exe PID 5020 wrote to memory of 1592 5020 igfxEM.exe schtasks.exe PID 5020 wrote to memory of 1592 5020 igfxEM.exe schtasks.exe PID 5020 wrote to memory of 1592 5020 igfxEM.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c1d783218c08ec713b483b0e51da0140_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5237.tmp"3⤵
- Creates scheduled task(s)
PID:4496 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3944
-
C:\Users\Admin\WinSAT\igfxEM.exeC:\Users\Admin\WinSAT\igfxEM.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵PID:1236
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2304
-
C:\Users\Admin\WinSAT\igfxEM.exeC:\Users\Admin\WinSAT\igfxEM.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵PID:3368
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn azroles /tr "C:\Users\Admin\WinSAT\igfxEM.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.logFilesize
496B
MD55b4789d01bb4d7483b71e1a35bce6a8b
SHA1de083f2131c9a763c0d1810c97a38732146cffbf
SHA256e248cef9500ed6e0c9f99d72a2a6a36955a5f0cfc0725748ef25a733cc8282f6
SHA512357e18ef30430e4b9cc4f2569b9735b1cd12f934c83162e4de78ac29ba9703b63ddb624ccc22afd5a5868f6e9d91a3c64581846abac22e9625f5b2e3d80b3ede
-
C:\Users\Admin\AppData\Local\Temp\tmp5237.tmpFilesize
1KB
MD5c6f0625bf4c1cdfb699980c9243d3b22
SHA143de1fe580576935516327f17b5da0c656c72851
SHA2568dfc4e937f0b2374e3ced25fce344b0731cf44b8854625b318d50ece2da8f576
SHA5129ef2dbd4142ad0e1e6006929376ecb8011e7ffc801ee2101e906787d70325ad82752df65839de9972391fa52e1e5974ec1a5c7465a88aa56257633ebb7d70969
-
C:\Users\Admin\WinSAT\igfxEM.exeFilesize
1.4MB
MD528b376648d12d1a7db253b69b2818a89
SHA134fff82ed3f46f4c87194705f072bf43c65c2770
SHA2566b9a9a66b78b1dcaaf4c0df898a459ca9e7f17dd6a2be15d37d7c37e2dc9e153
SHA512e5ca9e8711bb0727129fe31bccc186c8a04bcb1b1946edebf400b27ef8a746f1361ae883aa6cf7ac9510a877bbd6523157970f262fe1897b5777a1f3477a448a
-
C:\Users\Admin\azroles.lnkMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1236-20-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1572-2-0x00000000001A0000-0x00000000001D8000-memory.dmpFilesize
224KB
-
memory/1572-6-0x00000000739A2000-0x00000000739A3000-memory.dmpFilesize
4KB
-
memory/1572-7-0x00000000739A0000-0x0000000073F51000-memory.dmpFilesize
5.7MB
-
memory/1572-8-0x00000000739A0000-0x0000000073F51000-memory.dmpFilesize
5.7MB
-
memory/1572-16-0x00000000739A2000-0x00000000739A3000-memory.dmpFilesize
4KB
-
memory/1572-17-0x00000000739A0000-0x0000000073F51000-memory.dmpFilesize
5.7MB
-
memory/3220-0-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB