Overview

overview

6

Static

static

1

2bd5ad6fec...cs.exe

windows7-x64

6

2bd5ad6fec...cs.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/06/2024, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2bd5ad6fec683d99cba4a227d9fd79b0_NeikiAnalytics.exe
  • Size 2.3MB
  • Sample240617-blk2la1glm
  • SHA256 9e0841ac08c1346768f940c71cd3c8f35a3307202bf81627c07d7c9df7b6ab33
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
bootkitevasionpersistencetrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bd5ad6fec683d99cba4a227d9fd79b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2bd5ad6fec683d99cba4a227d9fd79b0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\LMI_Rescue.exe
      "C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\LMI_Rescue.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\LMI_Rescue_srv.exe
        "C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\LMI_Rescue_srv.exe" -wd "C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp"
        3⤵
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Writes to the Master Boot Record (MBR)
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4356

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LMI_Rescue.exe
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\LMI_Rescue.exe
        • Size 3.0MB
        • SHA256 3b0dad646ef6a74ad83e7199731ed121eaeac932b3cd0557390660657a2c0a18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Lmi_Rescue_srv.exe
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\Lmi_Rescue_srv.exe
        • Size 2.4MB
        • SHA256 c31616d13df62144e0e4aa36b4b02922693e1d34e655ed13cbcee251e46c601f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RescueWinRTLib.dll
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\RescueWinRTLib.dll
        • Size 139KB
        • SHA256 d3bd3a8fa26c771ca698b57d775095fda43d29d3c40cb158d8030d693f469f6b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        chatlog.dat
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\chatlog.dat
        • Size 113B
        • SHA256 ef47b6eca38751ccc265617cf887cc6481610bee346f43c0d50a0956a03bc07b
        • MD5 SHA1 SHA512
        Submit Download

        logo.bmp
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\logo.bmp
        • Size 3KB
        • SHA256 003aa4deb3d5184fb7b618df99b680611cbcfa3d764d5a2a210ff4cae5ec96b8
        • MD5 SHA1 SHA512
        Submit Download

        nvdaControllerClient32.dll
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\nvdaControllerClient32.dll
        • Size 136KB
        • SHA256 c74a95fd875afd00d84765aad6315ffe2d50f521c8a9ea2cbe1aa61e74215a9b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        params.txt
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\params.txt
        • Size 428B
        • SHA256 021eeb0e2ed5252933b9bf009683d6609a6daa590b854fb7003afa4b0556c9bb
        • MD5 SHA1 SHA512
        Submit Download

        rahook.dll
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rahook.dll
        • Size 398KB
        • SHA256 6e12a888387209cb1e1e8b12ce96a00dff438bb28e2a4e28e048cbbad2d0f607
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.ico
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.ico
        • Size 26KB
        • SHA256 63424e176b75642ebac9e5452eccc8c6956266dacc0ae4388d636d5bee5e7933
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.info
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.info
        • Size 248B
        • SHA256 3211e4297b0aab11cef488c146b05af3c7a55a10c4781262a543a8609ac321e7
        • MD5 SHA1 SHA512
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 13KB
        • SHA256 27ad088c40ae8238f56fabf6eecd29dfaed4b6c9297fc7ac2b9cdc8f91d0ed3a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 13KB
        • SHA256 5f8d2321ce449c1f8ad5c71cb55532af2fc1c4f2a23b7241e75e35e6c00b5d3a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 19KB
        • SHA256 5a7f8f56927e66fe6320f91596856470c9fdcab503c750732ab7e5f317963aad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 19KB
        • SHA256 807748045acc7a786b7c2b768142bc7d27ae8f38ec766ae97012067772416ece
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 25KB
        • SHA256 16652eab98cabf355c29fc1103b25855681e389c986f484dd2a19981862a089d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 25KB
        • SHA256 79165b4ff19c1d056c112dad8239410a38ef572e1170f804b5905370d77cebb5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 31KB
        • SHA256 06be74fdff9ef5c7a02807c8ee8293f465e562afd70217bd1bebf64600f2a2b4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 31KB
        • SHA256 866bced8ca9af4e95c22da4c2494864d100679930cda196c8da1414ba4cfa494
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 37KB
        • SHA256 862ce9ba61958fb5d00e9badf945707b4abb57ce728b56305472ea42f9728dc2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 37KB
        • SHA256 5c2a88fcba3b3c86989ab8ba28bf54c8c699f73b5a3b4d5e7aac15404dd7e988
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 43KB
        • SHA256 23b72a1b5cf553ddfa3c0e83b84e7eeca659b65c621169650bb5df6084f4bce8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 43KB
        • SHA256 61b9886a4765c7db8a5db77679ce98d0a6e14a2049ce3b9638bc1f124405f385
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 49KB
        • SHA256 ebfe2bf6015aad045c59185d2cbd2edabab599876a815960b308365ab6e2595d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 49KB
        • SHA256 5ccc34935651d3d19a053cb4764621a421cc47016a528304083661910de78a40
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 55KB
        • SHA256 23c17c8d75c681b70f6d547c74e2b0e16c0bea02ed6edbe727731aaac4c39672
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 55KB
        • SHA256 2da4efcc1e4182f80584fd5877f8b77c3f15c6f29d8e05e6a34ab7b9715f9845
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 61KB
        • SHA256 242b33c97fe71a8503135b1e8db61c291d66dc35b48c590a22e233aa37d2f9ed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 61KB
        • SHA256 043c9eaf96af114fd88fbcb6e6d7958bca29ed402bd9d9041692b8fc8499299f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 2KB
        • SHA256 4cac4c451212273ce1d64c658df913073e3292a3bd357d1c6e12233487e7c747
        • MD5 SHA1 SHA512
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 6KB
        • SHA256 efd4f0e4e1ecf1ed5dd5f90a382ce49207c5e4f36cdf8548aba92908e8dbb33b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 7KB
        • SHA256 3bc1361887306a746d83c43b71e1b41e5026e492fb233c5101fd987ea5e51d53
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 7KB
        • SHA256 a9da8fbfcd6c15d2ceef2f410c9b8e0059be2a24f9cc43e9f9bf39e11ccb257b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rescue.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\rescue.log
        • Size 7KB
        • SHA256 109f1d0cdda09e384be54c349502c1e406bc7eb3bcd3fd2f3b058b357fbe9370
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        session.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\session.log
        • Size 347B
        • SHA256 e0077c619ec9604456ca567254b5d44292934c8e733042cc40357a5e69507181
        • MD5 SHA1 SHA512
        Submit Download

        session.log
        • Path C:\Users\Admin\AppData\Local\LogMeIn Rescue Applet\LMIR01157001.tmp\session.log
        • Size 698B
        • SHA256 f18383cd3e821d4def997d31949299aff5008c95338f1ec7577fae1dd2e01772
        • MD5 SHA1 SHA512
        Submit Download