Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 05:05
Behavioral task
behavioral1
Sample
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe
-
Size
3.9MB
-
MD5
9274ffe5a8667a21bcc758547c894880
-
SHA1
098344d5070581b7f154a19e4356df5b304f10f5
-
SHA256
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47
-
SHA512
a41528634463dbefe414b4bf69f5f29b7cd180cc9af21ac178fb21a0a0643560d5a248428bf8667612a5077e31dc9b65e0e062f98550eb38783a89018d75ad87
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5C4:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmB4
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid process 2696 Soundcrd.exe 2468 Soundcrd.exe 2576 Soundcrd.exe -
Loads dropped DLL 7 IoCs
Processes:
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exeSoundcrd.exepid process 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 2696 Soundcrd.exe 2696 Soundcrd.exe -
Processes:
resource yara_rule behavioral1/memory/2376-0-0x0000000000400000-0x00000000007EC000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Soundcrd.exe upx behavioral1/memory/2696-47-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2376-46-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2468-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2576-64-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2576-69-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2696-68-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2576-66-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2468-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2576-73-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2468-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-84-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-88-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-92-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2468-96-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid process target process PID 2696 set thread context of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 set thread context of 2576 2696 Soundcrd.exe Soundcrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid process Token: SeIncreaseQuotaPrivilege 2468 Soundcrd.exe Token: SeSecurityPrivilege 2468 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2468 Soundcrd.exe Token: SeLoadDriverPrivilege 2468 Soundcrd.exe Token: SeSystemProfilePrivilege 2468 Soundcrd.exe Token: SeSystemtimePrivilege 2468 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2468 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2468 Soundcrd.exe Token: SeCreatePagefilePrivilege 2468 Soundcrd.exe Token: SeBackupPrivilege 2468 Soundcrd.exe Token: SeRestorePrivilege 2468 Soundcrd.exe Token: SeShutdownPrivilege 2468 Soundcrd.exe Token: SeDebugPrivilege 2468 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2468 Soundcrd.exe Token: SeChangeNotifyPrivilege 2468 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2468 Soundcrd.exe Token: SeUndockPrivilege 2468 Soundcrd.exe Token: SeManageVolumePrivilege 2468 Soundcrd.exe Token: SeImpersonatePrivilege 2468 Soundcrd.exe Token: SeCreateGlobalPrivilege 2468 Soundcrd.exe Token: 33 2468 Soundcrd.exe Token: 34 2468 Soundcrd.exe Token: 35 2468 Soundcrd.exe Token: SeDebugPrivilege 2576 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exepid process 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 2696 Soundcrd.exe 2576 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.execmd.exeSoundcrd.exedescription pid process target process PID 2376 wrote to memory of 2664 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 2376 wrote to memory of 2664 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 2376 wrote to memory of 2664 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 2376 wrote to memory of 2664 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 2664 wrote to memory of 2568 2664 cmd.exe reg.exe PID 2664 wrote to memory of 2568 2664 cmd.exe reg.exe PID 2664 wrote to memory of 2568 2664 cmd.exe reg.exe PID 2664 wrote to memory of 2568 2664 cmd.exe reg.exe PID 2376 wrote to memory of 2696 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 2376 wrote to memory of 2696 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 2376 wrote to memory of 2696 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 2376 wrote to memory of 2696 2376 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2468 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe PID 2696 wrote to memory of 2576 2696 Soundcrd.exe Soundcrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\wKFaT.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
PID:2568 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD5002a61a92759c10ed553f489c5ae8fb0
SHA11100468196094d2b95e6f80ed6ef8e463e8c8b63
SHA256684ff9f17d3e765316e6b89f210be3f5cedd0be58880d8c21263b0debb08ded8
SHA512a3d1f1c736c6139a1d427f5b9b90f49da9aa93711e0c15f8028a389648dd12a17f91a9b03c7b859d993e7ed49846fb632ec725909983cb9f5603cb43692bf677