94f7663820bfd71987b5084a70ce0289102f9114eb398c0a3e2532991767ee5b

Analysis

max time kernel
39s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.dll
Size 1.9MB
Sample240617-py47wsvgrq
SHA256 94f7663820bfd71987b5084a70ce0289102f9114eb398c0a3e2532991767ee5b
MD5 9058dbc11d1b6c18dc96d77b70678c20
SHA1 85d788f18e610fbab4dbc4b6df035aab51cca410
SHA512 258d6bf9c10843e321f33cbecc735ff3832b1f0a91795cf97faa3714760c530e00b8af6f2fa375f9ddc92d25c5d96c023efb4abe6b95c4f685fb2db0482c4503
SSDEEP 49152:Tg3mCtjGk4R9dSSFF4DUexww8V90vyRbOr0l1u:TgTJGkC98uSx6e6E
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3988	rundll32.exe
3988	rundll32.exe
3988	rundll32.exe
3988	rundll32.exe
3988	rundll32.exe
3988	rundll32.exe
3988	rundll32.exe
3988	rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3988	1168	rundll32.exe	82
PID 1168 wrote to memory of 3988	1168	rundll32.exe	82
PID 1168 wrote to memory of 3988	1168	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.dll,#1
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDMDownload.dll

Path C:\Users\Admin\AppData\Local\Temp\ugaeu\BDMDownload.dll
Size 158KB
SHA256 cbd4c5b6b945620e8b65752dff5a0f0900fc5de2dda8daf3cdda68b1661420b7
MD5 b62367fe2d02b8f47914b088a006d50c
SHA1 3743c953e48e6f3f76689423ba9c1ed25e9f86d3
SHA512 c010e3cc736ac1e10c6af44132d831df34d09bf1e7d1e96fb5c9f571cade04462d442c4b0fd84de92dc68d753a0beab0b4081122d53d516406f0d3c1ec1e0dbb
SSDEEP 3072:otmM/jSHRNnu+8ON7szLOkXcgpZDeIetjtGUBqz+:cvlZLeKUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDMNetGetInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\ugaeu\BDMNetGetInfo.dll
Size 314KB
SHA256 63e34375374ae6cc695c0bc03f1f9aad67e068fc51962fd25edbf2fbeceda9f9
MD5 12f98be1d919784370eb0f87e78b60d8
SHA1 d07de2227b2ec68545be0adeb042af457d68f9e2
SHA512 ab2fcdd3eb7b58f044a855b5cae744bc1b3be599cf0d22ee93ccce2e97cb3bc1f36ea2c1ed75013c76f8c9e4071ba29710595c3a57cda2470885ee9293fc2d8d
SSDEEP 6144:bG7eU2WtVv+Wd3ApMgM0+y6WdQO5OBEejov:a7y1IOVQtRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dl.dll

Path C:\Users\Admin\AppData\Local\Temp\ugaeu\dl.dll
Size 1.1MB
SHA256 46412d2bb040923639e7e5856ed28d734d84baba78d931e663e909f3cb07000a
MD5 73d5e66dfd5a67869773af0d03aa8d03
SHA1 e64f069f5da5e1ca5e0fd521f2e7492492afa795
SHA512 37ccfbfcf27e8906731800042856ab97573e150e2798c5b8bf05450e9563b0d3895996c7c055be470ee2c8307bec6e7408b0ac86a2568bf3beceadb21b37b281
SSDEEP 12288:e2FwemFCxJ9MORg6SdsgYKbIeDoiYbRL9S0qGwI4GdZ7qXzMvowpQJsBtzsX8F+p:hW4fVRZ4AiYqVGdKMQwpXnnVk83ReiK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3988-11-0x0000000000B30000-0x0000000000B58000-memory.dmp

Download

memory/3988-19-0x0000000002060000-0x00000000020AF000-memory.dmp

Download

memory/3988-27-0x0000000002260000-0x0000000002377000-memory.dmp

Download

memory/3988-35-0x0000000002D60000-0x0000000002DAF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads