Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 02:11

General

  • Target

    3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c_NeikiAnalytics.exe

  • Size

    732KB

  • MD5

    1e997e2884d9efd081c81c4afdfc74b0

  • SHA1

    c4d22928f3b4a7c39660aa3a9f176334bed6c205

  • SHA256

    3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c

  • SHA512

    689fce448ac825dfa3f125ffb8201bf24508ecaa72f9c68d5677d97d6ca7a53707e4765d0c2362579654143766a1fae86b89677a9a935c8de46302eed97bde39

  • SSDEEP

    12288:VpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/rb:nwAcu99lPzvxP+Bsz2XjWTRMQckkIXnz

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c_NeikiAnalytics.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
        PID:1484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1304-0-0x00000000002F0000-0x00000000002F1000-memory.dmp

      Filesize

      4KB

    • memory/1304-1-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-2-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-3-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-4-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-5-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-6-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-7-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-8-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-9-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-10-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-11-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-12-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-13-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/1304-14-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB