Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 02:11

General

  • Target

    3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c_NeikiAnalytics.exe

  • Size

    732KB

  • MD5

    1e997e2884d9efd081c81c4afdfc74b0

  • SHA1

    c4d22928f3b4a7c39660aa3a9f176334bed6c205

  • SHA256

    3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c

  • SHA512

    689fce448ac825dfa3f125ffb8201bf24508ecaa72f9c68d5677d97d6ca7a53707e4765d0c2362579654143766a1fae86b89677a9a935c8de46302eed97bde39

  • SSDEEP

    12288:VpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/rb:nwAcu99lPzvxP+Bsz2XjWTRMQckkIXnz

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3b5f4b83745a92ae503d587137f27b259e68a24e8b606a67553f588d6217764c_NeikiAnalytics.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Checks BIOS information in registry
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/908-0-0x00000000022D0000-0x00000000022D1000-memory.dmp

    Filesize

    4KB

  • memory/908-5-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-1-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-3-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-6-0x0000000001150000-0x0000000001151000-memory.dmp

    Filesize

    4KB

  • memory/2124-4-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-2-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-7-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-9-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-8-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-10-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

  • memory/2124-11-0x0000000001150000-0x0000000001151000-memory.dmp

    Filesize

    4KB