Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 05:05
Behavioral task
behavioral1
Sample
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe
-
Size
3.9MB
-
MD5
9274ffe5a8667a21bcc758547c894880
-
SHA1
098344d5070581b7f154a19e4356df5b304f10f5
-
SHA256
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47
-
SHA512
a41528634463dbefe414b4bf69f5f29b7cd180cc9af21ac178fb21a0a0643560d5a248428bf8667612a5077e31dc9b65e0e062f98550eb38783a89018d75ad87
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5C4:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmB4
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid process 5060 Soundcrd.exe 3948 Soundcrd.exe 3952 Soundcrd.exe -
Processes:
resource yara_rule behavioral2/memory/2940-1-0x0000000000400000-0x00000000007EC000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Soundcrd.txt upx behavioral2/memory/2940-28-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/memory/3948-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3952-42-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3952-46-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/5060-47-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/memory/3952-45-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3948-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3952-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3948-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3948-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid process target process PID 5060 set thread context of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 set thread context of 3952 5060 Soundcrd.exe Soundcrd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid process Token: SeIncreaseQuotaPrivilege 3948 Soundcrd.exe Token: SeSecurityPrivilege 3948 Soundcrd.exe Token: SeTakeOwnershipPrivilege 3948 Soundcrd.exe Token: SeLoadDriverPrivilege 3948 Soundcrd.exe Token: SeSystemProfilePrivilege 3948 Soundcrd.exe Token: SeSystemtimePrivilege 3948 Soundcrd.exe Token: SeProfSingleProcessPrivilege 3948 Soundcrd.exe Token: SeIncBasePriorityPrivilege 3948 Soundcrd.exe Token: SeCreatePagefilePrivilege 3948 Soundcrd.exe Token: SeBackupPrivilege 3948 Soundcrd.exe Token: SeRestorePrivilege 3948 Soundcrd.exe Token: SeShutdownPrivilege 3948 Soundcrd.exe Token: SeDebugPrivilege 3948 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 3948 Soundcrd.exe Token: SeChangeNotifyPrivilege 3948 Soundcrd.exe Token: SeRemoteShutdownPrivilege 3948 Soundcrd.exe Token: SeUndockPrivilege 3948 Soundcrd.exe Token: SeManageVolumePrivilege 3948 Soundcrd.exe Token: SeImpersonatePrivilege 3948 Soundcrd.exe Token: SeCreateGlobalPrivilege 3948 Soundcrd.exe Token: 33 3948 Soundcrd.exe Token: 34 3948 Soundcrd.exe Token: 35 3948 Soundcrd.exe Token: 36 3948 Soundcrd.exe Token: SeDebugPrivilege 3952 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exepid process 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe 5060 Soundcrd.exe 3952 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.execmd.exeSoundcrd.exedescription pid process target process PID 2940 wrote to memory of 4644 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 2940 wrote to memory of 4644 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 2940 wrote to memory of 4644 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe cmd.exe PID 4644 wrote to memory of 4200 4644 cmd.exe reg.exe PID 4644 wrote to memory of 4200 4644 cmd.exe reg.exe PID 4644 wrote to memory of 4200 4644 cmd.exe reg.exe PID 2940 wrote to memory of 5060 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 2940 wrote to memory of 5060 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 2940 wrote to memory of 5060 2940 51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3948 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe PID 5060 wrote to memory of 3952 5060 Soundcrd.exe Soundcrd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51ab1c749e055eb084a4ff5604ee852fd04763335578d95b108f21b76d4f2d47_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dnlkd.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
PID:4200 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3948 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3644,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:81⤵PID:3492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD51281e5db71b63286fe06e1f374db8cd8
SHA1575bf2af168809b6dff8c3ae79272bf05811c991
SHA2567c6bb448c9f4c8fb233c87319f76ac144cdc9b63752fa4589ddd84798ea8fd90
SHA512c15c1ba1aefa7ac6c8aa2830eaa3b65597c7e2cfa54045d3ab969dfc0649dece0c7e56d654f9fccd2bbe20638ae2652bb2b1413fc1e8f1471b6e6546ed3c08e8